JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 197.232.108.117

197.232.108.117 was found in our database!

This IP was reported 91 times. Confidence of Abuse is 92%: ?

92%

ISP	Jamii Telecommunications Limited
Usage Type	Fixed Line ISP
ASN	AS36866
Domain Name	jtl.co.ke
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 197.232.108.117

Whois 197.232.108.117

IP Abuse Reports for 197.232.108.117:

This IP address has been reported a total of 91 times from 42 distinct sources. 197.232.108.117 was first reported on March 10th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 QT	2026-06-05 08:59:01 (2 days ago)	Unauthorised WordPress admin login attempted at 2026-06-05 18:58:54 +1000	Web App Attack
🇫🇷 masterguru	2026-06-05 07:27:30 (2 days ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
Anonymous	2026-06-04 14:17:11 (2 days ago)	Attac	Brute-Force
🇨🇦 zXero	2026-06-03 12:32:23 (4 days ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
🇳🇱 Site.eu	2026-06-03 09:34:26 (4 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-06-03 09:06:46 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 197.232.108.117 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 197.232.108.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 05:06:38.907330 2026] [security2:error] [pid 6440:tid 6503] [client 197.232.108.117:63895] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.232.108.117 (+1 hits since last alert)\|morganswarsong.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "morganswarsong.com"] [uri "/xmlrpc.php"] [unique_id "ah_unm1UaVzlUNsvWayVXQAAAJc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-03 09:04:20 (4 days ago)	Attac	Brute-Force
🇩🇪 rh24	2026-06-02 14:41:55 (4 days ago)	(wordpress) Failed wordpress login from 197.232.108.117 (KE/Kenya/-): (CF_ENABLE)	Brute-Force
Anonymous	2026-06-02 12:02:19 (5 days ago)	[ssd5.kdns.gr] httpd-xmlrpc-post: sites=tentes-margaritis.gr; logs=/var/log/httpd/domains/tentes-mar ... show more [ssd5.kdns.gr] httpd-xmlrpc-post: sites=tentes-margaritis.gr; logs=/var/log/httpd/domains/tentes-margaritis.gr.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇨🇦 zXero	2026-05-29 12:26:37 (1 week ago)	Fail2Ban automatic report - jail: no-wordpress	Brute-Force SSH DDoS Attack
Anonymous	2026-05-29 11:17:20 (1 week ago)	(wordpress) Failed wordpress login from 197.232.108.117 (KE/Kenya/-)	Brute-Force
🇩🇪 grassau.com	2026-05-29 09:49:41 (1 week ago)	(wordpress) Failed wordpress login from 197.232.108.117 (KE/Kenya/Nairobi County/Nairobi/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-05-29 06:48:43 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 197.232.108.117 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 197.232.108.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 02:48:37.230751 2026] [security2:error] [pid 664:tid 664] [client 197.232.108.117:62947] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.232.108.117 (+1 hits since last alert)\|stellabluesales.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "stellabluesales.com"] [uri "/xmlrpc.php"] [unique_id "ahk2xZTvGparnbcxGTWx2QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 applemooz	2026-05-29 06:47:25 (1 week ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-28 13:09:05 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 197.232.108.117 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 197.232.108.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 09:08:59.325038 2026] [security2:error] [pid 22237:tid 22237] [client 197.232.108.117:51489] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.232.108.117 (+1 hits since last alert)\|heinsohn.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "heinsohn.com"] [uri "/xmlrpc.php"] [unique_id "ahg-a3bNaNPCr0hoTc_H5QAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 91 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇭 2001:4454:710:4300:8473:12ab:6999:a32e

🇺🇸 66.132.195.55

🇺🇸 45.49.170.236

🇺🇸 37.19.200.152

🇬🇧 35.203.211.198

🇨🇳 27.128.171.39

🇮🇳 2406:7400:63:5ee1:cddc:fa08:be3a:d9ee

🇬🇧 193.163.125.98

🇳🇱 185.226.197.34

🇺🇸 165.154.172.97

🇺🇸 135.119.53.108

🇳🇱 67.213.127.151

🇬🇧 35.203.211.18

🇬🇧 35.203.210.245

🇬🇧 35.203.210.238

🇺🇸 34.85.174.255

🇳🇱 195.178.110.30

🇬🇧 188.240.59.19

🇵🇰 153.117.6.118

🇺🇸 65.49.1.181