JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 197.221.254.11

197.221.254.11 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 71%: ?

71%

ISP	MPLS ADSL Broadband
Usage Type	Fixed Line ISP
ASN	AS37204
Hostname(s)	16.11.telone.co.zw
Domain Name	telone.co.zw
Country	🇿🇼 Zimbabwe
City	Bulawayo, Bulawayo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 197.221.254.11

Whois 197.221.254.11

IP Abuse Reports for 197.221.254.11:

This IP address has been reported a total of 27 times from 15 distinct sources. 197.221.254.11 was first reported on October 19th 2023, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 CoreTech srl	2026-08-21 09:43:57 (3 hours ago)	cloudlinux2 fail2ban: 2026-08-21 11:39:25,540 fail2ban.actions [1480]: NOTICE [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-21 11:39:25,540 fail2ban.actions [1480]: NOTICE [plesk-modsecurity] Unban 223.181.68.151cloudlinux2 fail2ban: 2026-08-21 11:39:35,701 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 43.250.158.55 - 2026-08-21 11:39:35cloudlinux2 fail2ban: 2026-08-21 11:39:31,786 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 197.221.254.11 - 2026-08-21 11:39:31cloudlinux2 fail2ban: 2026-08-21 11:40:13,685 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 64.89.161.82 - 2026-08-21 11:40:13cloudlinux2 fail2ban: 2026-08-21 11:40:13,810 fail2ban.actions [1480]: NOTICE [plesk-modsecurity] Ban 64.89.161.82cloudlinux2 fail2ban: 2026-08-21 11:40:13,715 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 64.89.161.82 - 2026-08-21 11:40:13cloudlinux2 fail2ban: 2026-08-21 11:40:13,726 fail2ban.filter [1480]: INFO [plesk-modsecurity] Found 64.89.161.82 - 2026-08-21 11:40:13cloudlinux2 fail2ban: 2026-08-21 11:40:13,6 show less	Brute-Force
🇫🇮 YF	2026-08-21 07:30:39 (5 hours ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇺🇸 TPI-Abuse	2026-08-21 06:40:59 (6 hours ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 02:40:55.608673 2026] [security2:error] [pid 1384:tid 1384] [client 197.221.254.11:3605] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|xcarsubscription.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "xcarsubscription.com"] [uri "/xmlrpc.php"] [unique_id "aofy92jjGn9xVf1sZKUksAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-21 05:38:45 (7 hours ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 01:38:38.021173 2026] [security2:error] [pid 13190:tid 13190] [client 197.221.254.11:20070] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|gracebaptisthartsville.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gracebaptisthartsville.com"] [uri "/xmlrpc.php"] [unique_id "aofkXih3E3ock9EvcLpsWAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ConsulHosting	2026-08-20 22:52:39 (14 hours ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 22:39:30 (14 hours ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 18:39:21.917503 2026] [security2:error] [pid 25424:tid 25424] [client 197.221.254.11:56635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|christineaholtz.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "christineaholtz.com"] [uri "/xmlrpc.php"] [unique_id "aoeCGaM7T1RgZDip9SopbQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-08-20 16:26:36 (20 hours ago)	Blocked by CSF 13 firewall - Rule: XMLRPC ZW/Zimbabwe/16.11.telone.co.zw	Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 15:57:54 (21 hours ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 11:57:47.393359 2026] [security2:error] [pid 2629:tid 2629] [client 197.221.254.11:59412] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|furbabieslivesmatter.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "furbabieslivesmatter.com"] [uri "/xmlrpc.php"] [unique_id "aocj-2_l0Dj-Edm8fNHQkAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 13:23:34 (23 hours ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 09:23:26.648191 2026] [security2:error] [pid 6672:tid 6672] [client 197.221.254.11:16670] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|arsenalfordemocracy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "arsenalfordemocracy.com"] [uri "/xmlrpc.php"] [unique_id "aob_zh79EAZY-vFcbqi5KwAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-08-20 10:17:45 (1 day ago)	(wordpress) Failed wordpress login from 197.221.254.11 (ZW/Zimbabwe/16.11.telone.co.zw)	Brute-Force
🇺🇸 TPI-Abuse	2026-08-20 08:49:25 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 04:49:21.472479 2026] [security2:error] [pid 20433:tid 20433] [client 197.221.254.11:30899] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|americanureport.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "americanureport.com"] [uri "/xmlrpc.php"] [unique_id "aoa_kYX3_jLiORIqHyW9_gAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-08-20 08:18:57 (1 day ago)	cloudlinux2 fail2ban: 2026-08-20 10:13:52,154 fail2ban.filter [1468]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-20 10:13:52,154 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 106.222.249.110 - 2026-08-20 10:13:51cloudlinux2 fail2ban: 2026-08-20 10:15:02,649 fail2ban.filter [1468]: INFO [plesk-wordpress] Found 136.144.43.48 - 2026-08-20 10:15:02cloudlinux2 fail2ban: 2026-08-20 10:15:02,647 fail2ban.filter [1468]: INFO [plesk-wordpress] Found 136.144.43.59 - 2026-08-20 10:15:02cloudlinux2 fail2ban: 2026-08-20 10:15:06,835 fail2ban.filter [1468]: INFO [plesk-wordpress] Found 136.144.43.48 - 2026-08-20 10:15:06cloudlinux2 fail2ban: 2026-08-20 10:15:16,293 fail2ban.actions [1468]: NOTICE [plesk-modsecurity] Unban 49.47.130.65cloudlinux2 fail2ban: 2026-08-20 10:15:15,154 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 180.153.236.20 - 2026-08-20 10:15:15cloudlinux2 fail2ban: 2026-08-20 10:16:30,515 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 197.221.254.11 - 2026-08-20 10:16:30cloudlinux2 fail2ban show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 06:14:05 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the l ... show more (mod_security) mod_security (id:240335) triggered by 197.221.254.11 (16.11.telone.co.zw): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 02:13:59.669373 2026] [security2:error] [pid 12098:tid 12098] [client 197.221.254.11:38017] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.221.254.11 (+1 hits since last alert)\|fetchamreadingroom.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fetchamreadingroom.org"] [uri "/xmlrpc.php"] [unique_id "aoabJyymKQJOYya-HNI2lgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-08-20 05:18:56 (1 day ago)	cloudlinux2 fail2ban: 2026-08-20 07:14:15,041 fail2ban.filter [1468]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-20 07:14:15,041 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 79.36.113.4 - 2026-08-20 07:14:15cloudlinux2 fail2ban: 2026-08-20 07:14:20,965 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 2.57.170.148 - 2026-08-20 07:14:20cloudlinux2 fail2ban: 2026-08-20 07:14:30,145 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 79.47.145.145 - 2026-08-20 07:14:30cloudlinux2 fail2ban: 2026-08-20 07:14:28,529 fail2ban.filter [1468]: INFO [plesk-modsecurity] Found 197.221.254.11 - 2026-08-20 07:14:28cloudlinux2 fail2ban: 2026-08-20 07:14:28,929 fail2ban.actions [1468]: NOTICE [plesk-modsecurity] Ban 197.221.254.11cloudlinux2 fail2ban: 2026-08-20 07:14:28,936 fail2ban.filter [1468]: INFO [recidive] Found 197.221.254.11 - 2026-08-20 07:14:28cloudlinux2 fail2ban: 2026-08-20 07:14:40,339 fail2ban.actions [1468]: NOTICE [plesk-wordpress] Unban 170.64.139.19cloudlinux2 fail2ban: 2026-08-20 07:14:41,548 fail2b show less	Web App Attack
🇧🇪 taivas.nl	2026-08-20 00:32:12 (1 day ago)	Wordpress_xmlrpc_attack	Bad Web Bot

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 170.130.187.42

🇬🇧 23.229.7.254

🇳🇴 20.251.112.238

🇮🇳 220.225.7.117

🇦🇹 213.225.6.62

🇺🇸 192.81.131.122

🇺🇸 172.70.100.90

🇻🇳 171.231.197.30

🇸🇬 114.119.159.237

🇺🇸 65.49.20.123

🇺🇸 64.62.156.167

🇳🇱 45.148.10.152

🇸🇬 35.187.231.181

🇳🇱 34.91.0.68

🇫🇷 2400:cb00:534:1000:2879:3763:2166:73a7

🇰🇷 211.227.110.14

🇺🇸 184.105.247.230

🇺🇸 165.245.172.73

🇷🇺 94.26.130.173

🇧🇷 45.226.12.159