JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 41.203.212.69

41.203.212.69 was found in our database!

This IP was reported 51 times. Confidence of Abuse is 91%: ?

91%

ISP	Safaricom Limited
Usage Type	Fixed Line ISP
ASN	AS37061
Hostname(s)	41-203-212-69.safaricombusiness.co.ke
Domain Name	safaricom.co.ke
Country	🇰🇪 Kenya
City	Nanyuki, Laikipia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 41.203.212.69

Whois 41.203.212.69

IP Abuse Reports for 41.203.212.69:

This IP address has been reported a total of 51 times from 31 distinct sources. 41.203.212.69 was first reported on October 13th 2025, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 big-cloud.nl	2026-06-22 16:15:25 (2 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 ambor	2026-06-22 05:35:30 (13 hours ago)	Honeypot access: WordPress XML-RPC attack attempt. Path: /xmlrpc.php	Brute-Force Web App Attack
🇩🇪 LRob.fr	2026-06-21 23:30:17 (19 hours ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 oralunal	2026-06-21 15:56:50 (1 day ago)	IP banned by Fail2Ban in jail oral-suss access.log mvfnds ...	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-20 13:10:41 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 41.203.212.69 (41-203-212-69.safaricombusiness. ... show more (mod_security) mod_security (id:225170) triggered by 41.203.212.69 (41-203-212-69.safaricombusiness.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 09:10:37.232926 2026] [security2:error] [pid 29668:tid 29668] [client 41.203.212.69:58138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|gabbyspetnanny.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gabbyspetnanny.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajaRTbdU6aUIwknQIuC_6wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-19 07:18:03 (3 days ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇫🇮 KnightIndustries	2026-06-18 13:03:15 (4 days ago)	2026-06-18T15:02:08.767537+02:00 milkyway wordpress(oldscarborough.com)[36563]: XML-RPC authenticati ... show more 2026-06-18T15:02:08.767537+02:00 milkyway wordpress(oldscarborough.com)[36563]: XML-RPC authentication failure for joshua from 41.203.212.69 2026-06-18T15:02:39.960099+02:00 milkyway wordpress(oldscarborough.com)[61143]: XML-RPC authentication failure for joshua from 41.203.212.69 2026-06-18T15:03:14.965988+02:00 milkyway wordpress(oldscarborough.com)[39674]: XML-RPC authentication failure for joshua from 41.203.212.69 ... show less	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-06-18 01:15:25 (4 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇨🇭 4server	2026-06-17 18:45:15 (5 days ago)	[WedJun1720:45:08.6134732026][security2:error][pid2329669:tid2329994][client41.203.212.69:0]ModSecur ... show more [WedJun1720:45:08.6134732026][security2:error][pid2329669:tid2329994][client41.203.212.69:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"retepastoralebelli.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajLrNCk3CPGeiSMa9L94cQAAAMQ\"] show less	Hacking Web App Attack
🇬🇷 setupgr	2026-06-16 14:31:57 (6 days ago)	(XMLRPC) WP XMLPRC Attack 41.203.212.69: 1 in the last 86400 secs; Ports: ; Direction: inout; Trigg ... show more (XMLRPC) WP XMLPRC Attack 41.203.212.69: 1 in the last 86400 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: 41.203.212.69 - - [16/Jun/2026:17:25:50 +0300] "POST /xmlrpc.php HTTP/1.1" 301 303 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" show less	Port Scan
🇳🇱 Site.eu	2026-06-16 10:46:32 (6 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 grassau.com	2026-06-16 10:44:06 (6 days ago)	(wordpress) Failed wordpress login from 41.203.212.69 (KE/Kenya/Nairobi County/Nairobi/41-203-212-69 ... show more (wordpress) Failed wordpress login from 41.203.212.69 (KE/Kenya/Nairobi County/Nairobi/41-203-212-69.safaricombusiness.co.ke) show less	Brute-Force
🇩🇪 big-cloud.nl	2026-06-15 22:51:51 (6 days ago)	Try to access /huisje-huren/xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 18:29:35 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 41.203.212.69 (41-203-212-69.safaricombusiness. ... show more (mod_security) mod_security (id:225170) triggered by 41.203.212.69 (41-203-212-69.safaricombusiness.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 14:29:27.821740 2026] [security2:error] [pid 13124:tid 13124] [client 41.203.212.69:64062] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|d365geek.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "d365geek.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajBEh1GoIxvqTOJ3zAMg2QAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 07:59:32 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 41.203.212.69 (41-203-212-69.safaricombusiness. ... show more (mod_security) mod_security (id:225170) triggered by 41.203.212.69 (41-203-212-69.safaricombusiness.co.ke): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 03:59:28.990819 2026] [security2:error] [pid 2838:tid 2865] [client 41.203.212.69:63218] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|minutosrobados.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "minutosrobados.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai-w4MAV3tQA5vHXjWNnggAAAJU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.73.160.3

🇳🇱 176.65.139.158

🇺🇸 45.8.19.99

🇩🇪 185.242.3.226

🇩🇪 161.35.65.86

🇨🇳 150.255.99.99

🇺🇸 141.11.88.3

🇧🇬 78.128.114.110

🇷🇴 2.57.122.177

🇬🇧 193.163.125.56

🇵🇹 181.214.37.154

🇺🇸 65.49.1.230

🇺🇸 64.62.156.52

🇮🇳 35.200.191.248

🇮🇪 2a05:d018:10df:d401:83c5:ca8d:d42d:b0c1

🇺🇸 2604:a880:400:d1:0:4:9e75:f001

🇺🇸 195.184.76.117

🇩🇪 193.46.232.244

🇮🇳 122.170.100.253

🇮🇪 54.246.131.71