JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.209.109.154

102.209.109.154 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 55%: ?

55%

ISP	Hosting Operations
Usage Type	Fixed Line ISP
ASN	AS329415
Domain Name	savannafibre.co.ug
Country	🇺🇬 Uganda
City	Kampala, Central Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.209.109.154

Whois 102.209.109.154

IP Abuse Reports for 102.209.109.154:

This IP address has been reported a total of 15 times from 12 distinct sources. 102.209.109.154 was first reported on February 24th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 debestelapp	2026-07-12 15:45:05 (1 day ago)		Web App Attack
Anonymous	2026-07-12 13:53:13 (1 day ago)	(wordpress) Failed wordpress login from 102.209.109.154 (UG/Uganda/-)	Brute-Force
🇺🇸 IndigoRidge	2026-07-12 10:01:16 (2 days ago)	102.209.109.154 - - [12/Jul/2026:05:59:40 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5530 "-" "WordPress ... show more 102.209.109.154 - - [12/Jul/2026:05:59:40 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5530 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [12/Jul/2026:05:59:51 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5530 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [12/Jul/2026:06:00:23 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5530 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [12/Jul/2026:06:01:05 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5530 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [12/Jul/2026:06:01:16 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5530 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 00:01:56 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 102.209.109.154 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 102.209.109.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 20:01:52.263538 2026] [security2:error] [pid 18598:tid 18598] [client 102.209.109.154:19309] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.209.109.154 (+1 hits since last alert)\|psychiatryabuse.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "psychiatryabuse.com"] [uri "/xmlrpc.php"] [unique_id "alLZcEnllLM1FMaocm2kUAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 23:01:38 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 102.209.109.154 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 102.209.109.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 19:01:34.357625 2026] [security2:error] [pid 9986:tid 9986] [client 102.209.109.154:16205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.209.109.154 (+1 hits since last alert)\|aifactoid.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aifactoid.com"] [uri "/xmlrpc.php"] [unique_id "alLLTgZcNQnH8M3B8ifUcAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 20:58:57 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 102.209.109.154 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 102.209.109.154 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 16:58:48.637223 2026] [security2:error] [pid 25742:tid 25742] [client 102.209.109.154:16309] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.209.109.154 (+1 hits since last alert)\|airdriedrivingschool.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "airdriedrivingschool.com"] [uri "/xmlrpc.php"] [unique_id "alKuiL8AFuTWbYqQX0xnSgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 konseptit	2026-07-11 19:54:41 (2 days ago)	(wordpress) Failed wordpress login from 102.209.109.154 (UG/Uganda/-)	Brute-Force
🇧🇪 cmbplf	2026-07-11 00:46:35 (3 days ago)	2.614 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇺🇸 IndigoRidge	2026-07-10 21:49:00 (3 days ago)	102.209.109.154 - - [10/Jul/2026:17:47:43 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4834 "-" "WordPress ... show more 102.209.109.154 - - [10/Jul/2026:17:47:43 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4834 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [10/Jul/2026:17:47:54 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4834 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [10/Jul/2026:17:48:05 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4834 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [10/Jul/2026:17:48:38 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4834 "-" "WordPress.com; https://wordpress.com" 102.209.109.154 - - [10/Jul/2026:17:48:59 -0400] "POST /xmlrpc.php HTTP/1.0" 403 4834 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇩🇪 Séfora Srl	2026-07-10 18:03:17 (3 days ago)	Failed attempt detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇩🇪 Vegascosmetics	2026-07-06 01:10:28 (1 week ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇺🇸 [email protected]	2026-06-07 07:38:18 (1 month ago)	Ports: 52734. Proto: UDP. Observations: 1	Port Scan
🇺🇸 Cyber Crusader	2026-06-07 05:51:56 (1 month ago)	Hundreds of Attempts (at least) to Connect to and Access Firewall Ports	Port Scan Hacking Brute-Force
Anonymous	2026-06-03 09:30:45 (1 month ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2026-02-24 19:07:38 (4 months ago)	Web App Attack	Brute-Force Exploited Host Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 202.46.62.108

🇧🇷 168.196.222.34

🇺🇸 162.216.150.134

🇭🇰 156.225.1.87

🇫🇮 147.185.133.220

🇨🇳 115.190.197.138

🇬🇧 5.252.83.110

🇳🇱 195.178.110.26

🇺🇸 185.238.231.160

🇨🇴 181.234.3.60

🇺🇸 167.172.124.8

🇺🇸 162.240.75.182

🇸🇪 143.14.22.106

🇧🇬 79.124.56.246

🇻🇳 14.236.39.171

🇨🇳 14.29.214.161

🇬🇧 3.8.29.81

🇵🇱 2a09:bac5:506d:2432::39b:d2

🇺🇸 216.25.89.114

🇮🇳 157.15.158.247