JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 41.215.128.124

41.215.128.124 was found in our database!

This IP was reported 65 times. Confidence of Abuse is 82%: ?

82%

ISP	Faiba assignement
Usage Type	Fixed Line ISP
ASN	AS36866
Domain Name	jtl.co.ke
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 41.215.128.124

Whois 41.215.128.124

IP Abuse Reports for 41.215.128.124:

This IP address has been reported a total of 65 times from 27 distinct sources. 41.215.128.124 was first reported on March 2nd 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 WeekendWeb	2026-07-11 17:44:47 (1 day ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 n2nguyenn2nguyen	2026-07-11 17:44:06 (1 day ago)	Blocked by YFC Security on https://fencingforward.com — type: xmlrpc_attempts	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-11 08:06:22 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-10 12:40:06 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 08:39:57.807313 2026] [security2:error] [pid 22555:tid 22555] [client 41.215.128.124:58868] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 41.215.128.124 (+1 hits since last alert)\|aandbnaturalfoods.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aandbnaturalfoods.com"] [uri "/xmlrpc.php"] [unique_id "alDoHURJlz9kkty07_MPfAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 05:39:14 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 01:39:04.445835 2026] [security2:error] [pid 32375:tid 32375] [client 41.215.128.124:57894] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 41.215.128.124 (+1 hits since last alert)\|kdgsf.xyz\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kdgsf.xyz"] [uri "/xmlrpc.php"] [unique_id "ak8z-LrBOsS6Y8L2FBJ1ngAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TAY	2026-07-09 05:35:01 (4 days ago)	41.215.128.124 - - [09/Jul/2026:13:34:39 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack by ... show more 41.215.128.124 - - [09/Jul/2026:13:34:39 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)" 41.215.128.124 - - [09/Jul/2026:13:34:49 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.3)" 41.215.128.124 - - [09/Jul/2026:13:35:00 +0800] "POST /xmlrpc.php HTTP/1.1" 200 5935 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-08 11:40:21 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 07:40:08.777042 2026] [security2:error] [pid 18132:tid 18132] [client 41.215.128.124:61440] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 41.215.128.124 (+1 hits since last alert)\|avantgarde-hk.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "avantgarde-hk.org"] [uri "/xmlrpc.php"] [unique_id "ak43GAno40hhpVmE-gSMTAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 08:49:29 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 04:49:23.047002 2026] [security2:error] [pid 10897:tid 10897] [client 41.215.128.124:63858] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 41.215.128.124 (+1 hits since last alert)\|globaldentalservices.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "globaldentalservices.com"] [uri "/xmlrpc.php"] [unique_id "aktsE8PrvIQCqHHiqQGVmgAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 konseptit	2026-07-06 08:32:48 (1 week ago)	(wordpress) Failed wordpress login from 41.215.128.124 (KE/Kenya/-)	Brute-Force
🇺🇸 bigwavedave	2026-07-06 08:11:54 (1 week ago)	Wordpress Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 07:58:49 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 03:58:41.840445 2026] [security2:error] [pid 6141:tid 6141] [client 41.215.128.124:65440] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 41.215.128.124 (+1 hits since last alert)\|univey.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "univey.com"] [uri "/xmlrpc.php"] [unique_id "aktgMSZTUZ5If4IQgOFhYQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-06 05:18:41 (1 week ago)	(wordpress) Failed wordpress login from 41.215.128.124 (KE/Kenya/Nairobi County/Nairobi/-/[redacted] ... show more (wordpress) Failed wordpress login from 41.215.128.124 (KE/Kenya/Nairobi County/Nairobi/-/[redacted]) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-05 16:45:10 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 41.215.128.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 12:45:04.073194 2026] [security2:error] [pid 23171:tid 23191] [client 41.215.128.124:50732] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 41.215.128.124 (+1 hits since last alert)\|plumeraproductions.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "plumeraproductions.com"] [uri "/xmlrpc.php"] [unique_id "akqKEEb6tlCM80-X_CaZfgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-05 16:44:30 (1 week ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇧🇪 cmbplf	2026-07-04 10:32:10 (1 week ago)	6.867 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot

Showing 1 to 15 of 65 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 194.165.16.166

🇵🇱 176.53.159.198

🇰🇷 103.129.185.85

🇫🇷 85.217.140.29

🇳🇱 5.61.209.224

🇦🇴 154.116.254.157

🇮🇩 103.155.246.150

🇳🇱 91.92.40.50

🇫🇷 85.217.140.43

🇺🇸 72.17.34.38

🇩🇪 213.209.159.236

🇧🇷 201.222.20.20

🇳🇱 195.178.110.137

🇸🇬 159.223.93.39

🇷🇴 92.118.39.49

🇺🇸 66.132.186.252

🇧🇪 34.156.110.9

🇧🇷 2804:2d24:2ea:6a00:32c5:99ff:fecc:e3d3

🇭🇰 152.32.239.90

🇺🇸 150.107.38.16