JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 197.245.26.71

197.245.26.71 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 43%: ?

43%

ISP	Vox Telecom
Usage Type	Fixed Line ISP
ASN	AS11845
Hostname(s)	dsl-197-245-26-71.voxdsl.co.za
Domain Name	vox.co.za
Country	🇿🇦 South Africa
City	Johannesburg, Gauteng

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 197.245.26.71

Whois 197.245.26.71

IP Abuse Reports for 197.245.26.71:

This IP address has been reported a total of 11 times from 6 distinct sources. 197.245.26.71 was first reported on August 19th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 IndigoRidge	2026-08-25 08:22:31 (3 hours ago)	197.245.26.71 - - [25/Aug/2026:04:19:53 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5782 "-" "WordPress.c ... show more 197.245.26.71 - - [25/Aug/2026:04:19:53 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5782 "-" "WordPress.com; https://wordpress.com" 197.245.26.71 - - [25/Aug/2026:04:20:35 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5782 "-" "WordPress.com; https://wordpress.com" 197.245.26.71 - - [25/Aug/2026:04:21:06 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5782 "-" "WordPress.com; https://wordpress.com" 197.245.26.71 - - [25/Aug/2026:04:21:27 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5782 "-" "WordPress.com; https://wordpress.com" 197.245.26.71 - - [25/Aug/2026:04:22:30 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5782 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇦🇺 screwlooseit.com.au	2026-08-25 08:00:22 (3 hours ago)	Blocked by CSF 13 firewall - Rule: XMLRPC ZA/South Africa/dsl-197-245-26-71.voxdsl.co.za	Web App Attack
🇫🇷 dynamix	2026-08-24 09:28:49 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-08-24 09:20:55 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-24 08:57:56 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 08:19:37 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): ... show more (mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 04:19:29.524834 2026] [security2:error] [pid 28268:tid 28268] [client 197.245.26.71:51184] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.245.26.71 (+1 hits since last alert)\|blaslandsporthorses.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "blaslandsporthorses.com"] [uri "/xmlrpc.php"] [unique_id "aov-kYmauXXuI429RyFnCgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-21 10:55:33 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): ... show more (mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 06:55:28.611202 2026] [security2:error] [pid 19676:tid 19676] [client 197.245.26.71:51571] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.245.26.71 (+1 hits since last alert)\|nextlevelcharge.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nextlevelcharge.com"] [uri "/xmlrpc.php"] [unique_id "aoguoHPHL0g7PndrK2NGyAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 10:06:19 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): ... show more (mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 06:06:10.171303 2026] [security2:error] [pid 17989:tid 17989] [client 197.245.26.71:54673] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.245.26.71 (+1 hits since last alert)\|97films.media\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "97films.media"] [uri "/xmlrpc.php"] [unique_id "aobRkoaVWBVyQFk6VxuGcwAAAIY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 06:26:12 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): ... show more (mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 02:26:04.692649 2026] [security2:error] [pid 1998:tid 1998] [client 197.245.26.71:62077] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.245.26.71 (+1 hits since last alert)\|adona.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "adona.org"] [uri "/xmlrpc.php"] [unique_id "aoad_MiKCnlJ46uJHt4pkAAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-19 10:56:38 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): ... show more (mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 06:56:34.831388 2026] [security2:error] [pid 8412:tid 8417] [client 197.245.26.71:51854] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.245.26.71 (+1 hits since last alert)\|annacaird.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "annacaird.com"] [uri "/xmlrpc.php"] [unique_id "aoWL4i1AxSh2stzejdaWOwAAAYM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-19 09:34:59 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): ... show more (mod_security) mod_security (id:240335) triggered by 197.245.26.71 (dsl-197-245-26-71.voxdsl.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 05:34:54.097463 2026] [security2:error] [pid 24291:tid 24291] [client 197.245.26.71:51576] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 197.245.26.71 (+1 hits since last alert)\|nebraskaadaptivesports.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nebraskaadaptivesports.org"] [uri "/xmlrpc.php"] [unique_id "aoV4vtFUfl2s4_XP37HJIQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 185.180.141.68

🇲🇽 157.137.187.229

🇷🇴 130.195.241.7

🇨🇳 124.88.113.137

🇻🇳 123.16.85.214

🇫🇷 91.196.152.77

🇨🇦 85.217.149.24

🇰🇷 61.37.150.6

🇺🇸 45.145.131.20

🇧🇷 201.182.62.205

🇺🇸 185.180.141.34

🇺🇸 91.230.168.148

🇨🇦 85.217.149.35

🇨🇦 85.217.149.34

🇲🇾 47.250.95.66

🇨🇳 42.185.57.63

🇭🇰 8.210.75.243

🇺🇸 195.184.76.79

🇺🇸 195.184.76.73

🇺🇸 162.216.150.110