JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 41.158.104.107

41.158.104.107 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 48%: ?

48%

ISP	Réseau Internet IPMPLS partie Backbone
Usage Type	Fixed Line ISP
ASN	AS16058
Domain Name	moov-africa.ga
Country	🇬🇦 Gabon
City	Libreville, Estuaire

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 41.158.104.107

Whois 41.158.104.107

IP Abuse Reports for 41.158.104.107:

This IP address has been reported a total of 10 times from 8 distinct sources. 41.158.104.107 was first reported on July 18th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 omc	2026-07-27 01:22:03 (1 day ago)	POST /xmlrpc.php [Q4].	Bad Web Bot
🇫🇷 dynamix	2026-07-26 22:39:25 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 15:08:07 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 41.158.104.107 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 41.158.104.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 11:07:58.654517 2026] [security2:error] [pid 2855814:tid 2855814] [client 41.158.104.107:53708] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|citizensforsanity.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "citizensforsanity.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amYizo41wHWSdvjCsECNfQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇴 jad-abuse	2026-07-23 00:33:24 (5 days ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. O ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: xmlrpc. Observed by 1 sensor(s); 1 hits. show less	Brute-Force Web App Attack
🇩🇪 4server	2026-07-21 23:03:55 (6 days ago)	[WedJul2201:03:48.7772322026][security2:error][pid3720022:tid3720091][client41.158.104.107:0]ModSecu ... show more [WedJul2201:03:48.7772322026][security2:error][pid3720022:tid3720091][client41.158.104.107:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"autoeuro.lv\"][uri\"/xmlrpc.php\"][unique_id\"al_61BDm_Yqn_0Sahsp8wAAAAIA\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 directorioeducativo.com	2026-07-20 15:56:51 (1 week ago)	POST URL: "/xmlrpc.php"Agent: "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Ge ... show more POST URL: "/xmlrpc.php"Agent: "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.0.0 Safari/537.36" show less	Web App Attack
🇧🇪 taivas.nl	2026-07-20 01:02:13 (1 week ago)	Wordpress_xmlrpc_attack	Bad Web Bot
🇩🇪 4server	2026-07-19 23:55:34 (1 week ago)	[MonJul2001:55:32.3899002026][security2:error][pid1118777:tid1118788][client41.158.104.107:0]ModSecu ... show more [MonJul2001:55:32.3899002026][security2:error][pid1118777:tid1118788][client41.158.104.107:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"grigorov.ch\"][uri\"/xmlrpc.php\"][unique_id\"al1j9BYPZBNWrtQzNSepNgAAAIg\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-07-18 21:56:46 (1 week ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 17:46:16 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 41.158.104.107 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 41.158.104.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 13:46:09.702596 2026] [security2:error] [pid 12955:tid 12955] [client 41.158.104.107:62977] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|medusakenya.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "medusakenya.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alu74dGlT-QQCQ7r5I89cgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇿 212.47.128.6

🇲🇿 102.209.248.22

🇹🇳 196.187.58.139

🇵🇱 185.241.208.244

🇨🇱 179.60.66.157

🇨🇦 172.105.23.195

🇺🇸 152.232.5.139

🇺🇸 103.168.67.253

🇩🇪 87.106.29.151

🇩🇪 85.214.84.94

🇺🇸 70.44.161.20

🇺🇸 64.227.1.192

🇺🇸 152.232.5.138

🇺🇸 151.240.44.150

🇨🇦 138.197.166.254

🇨🇳 121.229.107.184

🇨🇳 117.72.243.50

🇬🇧 91.109.113.43

🇩🇪 77.22.211.47

🇹🇼 61.222.211.114