JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 197.221.251.234

197.221.251.234 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 73%: ?

73%

ISP	MPLS ADSL Broadband
Usage Type	Fixed Line ISP
ASN	AS37204
Domain Name	telone.co.zw
Country	🇿🇼 Zimbabwe
City	Harare, Harare

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 197.221.251.234

Whois 197.221.251.234

IP Abuse Reports for 197.221.251.234:

This IP address has been reported a total of 29 times from 22 distinct sources. 197.221.251.234 was first reported on August 9th 2025, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 maxxsense	2026-10-17 04:01:20 (14 hours ago)	(PERMBLOCK) 197.221.251.234 (ZW/Zimbabwe/16.234.telone.co.zw) has had more than 4 temp blocks	Hacking
🇳🇱 maxxsense	2026-10-16 12:32:10 (1 day ago)	(wordpress) Failed wordpress login from 197.221.251.234 (ZW/Zimbabwe/16.234.telone.co.zw)	Brute-Force
🇺🇸 RH5	2026-10-16 05:27:06 (1 day ago)	Restricted URL probing (/xmlrpc.php) (UTC 2026-10-16 05:27)	Web App Attack
🇫🇮 inlink.ltd	2026-10-15 04:22:40 (2 days ago)	Known malicious PHP file or CMS probe	Web App Attack
🇳🇱 ipoac.nl	2026-10-15 04:11:26 (2 days ago)	-:443 197.221.251.234 - - [15/Oct/2026:06:11:26 +0200] - "POST /xmlrpc.php HTTP/1.1" 404 5903 "-" "M ... show more -:443 197.221.251.234 - - [15/Oct/2026:06:11:26 +0200] - "POST /xmlrpc.php HTTP/1.1" 404 5903 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/99.0.0.0 Safari/537.36" show less	Bad Web Bot
🇪🇸 robotstxt	2026-10-14 22:09:08 (2 days ago)	197.221.251.234 - - [14/Oct/2026:22:08:04 +0000] "GET /xmlrpc.php HTTP/1.1" 403 77569 "-" "Mozilla/5 ... show more 197.221.251.234 - - [14/Oct/2026:22:08:04 +0000] "GET /xmlrpc.php HTTP/1.1" 403 77569 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/87.0.0.0 Safari/537.36" "-" edge="197.221.251.234" 197.221.251.234 - - [14/Oct/2026:22:08:11 +0000] "GET /xmlrpc.php HTTP/1.1" 403 77564 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/63.0.0.0 Safari/537.36" "-" edge="197.221.251.234" 197.221.251.234 - - [14/Oct/2026:22:08:27 +0000] "GET /xmlrpc.php HTTP/1.1" 403 77571 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/71.0.0.0 Safari/537.36" "-" edge="197.221.251.234" 197.221.251.234 - - [14/Oct/2026:22:08:32 +0000] "GET /xmlrpc.php HTTP/1.1" 403 77569 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/92.0.0.0 Safari/537.36" "-" edge="197.221.251.234" 197.221.251.234 - - [14/Oct/2026:22:08:44 +0000] "GET /xmlrpc.php HTTP/1.1" 403 77569 "-" " ... show less	Web App Attack
Anonymous	2026-10-14 22:06:08 (2 days ago)	Trying to access config files	Web App Attack
🇺🇸 WellSpring	2026-10-14 19:11:08 (2 days ago)	xmlrpc exploit on wellspr.ing/xmlrpc.php — WellSpr.ing/NetSentinel civic-AI security layer	Brute-Force Web App Attack
🇩🇪 stinpriza	2026-10-14 13:39:09 (3 days ago)	Web App Attack	Web App Attack
🇩🇪 LRob	2026-10-14 13:25:53 (3 days ago)	WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Windows NT 10.0; x ... show more WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.0.0 Safari/537.36 show less	Web App Attack Hacking
🇫🇮 KnightIndustries	2026-10-13 23:59:06 (3 days ago)	2026-10-14T01:58:04.245393+02:00 milkyway wordpress(oldscarborough.com)[2868649]: XML-RPC authentica ... show more 2026-10-14T01:58:04.245393+02:00 milkyway wordpress(oldscarborough.com)[2868649]: XML-RPC authentication failure for joshua from 197.221.251.234 2026-10-14T01:58:35.003276+02:00 milkyway wordpress(oldscarborough.com)[2870744]: XML-RPC authentication failure for joshua from 197.221.251.234 2026-10-14T01:59:05.013365+02:00 milkyway wordpress(oldscarborough.com)[2869867]: XML-RPC authentication failure for joshua from 197.221.251.234 ... show less	Brute-Force Web App Attack
🇬🇧 consul.to	2026-10-13 20:13:08 (3 days ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 xmission.com	2026-09-18 15:34:24 (4 weeks ago)	Blocked by UFW (TCP on 23) Source port: 13935 TTL: 243 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 23) Source port: 13935 TTL: 243 Packet length: 60 TOS: 0x00 This report (for 197.221.251.234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇬🇪 ORDUNET	2026-09-15 10:23:05 (1 month ago)	Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordu ... show more Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordunet), Georgia, on 2026-09-15 from 14:17 local time (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 200 packets/sec for a legitimate player of that server. It was one of 8847 sources in 2396 networks and 160 countries recorded inside a single 25-minute window - the server's entire real audience is about a hundred players. Detected on a MikroTik RouterOS router in the raw/prerouting chain (dst-limit 800,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - a packet flood, so the host is most likely compromised. Evidence: [email protected]. show less	DDoS Attack Exploited Host
🇺🇸 鬼影233	2026-09-08 20:59:45 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 2a0f:ca80:b00b:3141::5

🇨🇳 2401:b180:7003::218

🇧🇬 193.24.211.219

🇨🇭 179.43.175.22

🇮🇶 65.20.143.19

🇸🇬 47.84.140.213

🇮🇩 2404:c0:bb01:5fec:7174:c129:a24a:ed8d

🇺🇸 198.98.62.211

🇬🇧 194.50.235.151

🇨🇳 118.183.180.108

🇳🇱 109.160.32.143

🇩🇪 64.89.160.202

🇳🇬 41.223.139.111

🇹🇼 34.80.82.61

🇨🇦 34.19.254.241

🇦🇷 186.122.177.140

🇰🇿 185.121.81.176

🇧🇷 137.131.248.20

🇨🇳 118.196.142.135

🇳🇱 77.239.124.71