JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 129.222.147.25

129.222.147.25 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 51%: ?

51%

ISP	SpaceX Services, Inc.
Usage Type	Fixed Line ISP
ASN	AS14593
Hostname(s)	customer.nrbiken1.isp.starlink.com
Domain Name	spacex.com
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 129.222.147.25

Whois 129.222.147.25

IP Abuse Reports for 129.222.147.25:

This IP address has been reported a total of 48 times from 25 distinct sources. 129.222.147.25 was first reported on December 14th 2024, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 el-brujo	2026-08-26 13:01:11 (14 hours ago)	HTTP DDoS Attack Layer 7	DDoS Attack
🇺🇸 gui-ying233	2026-08-23 19:03:50 (3 days ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-08-23 08:02:03 (3 days ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-21 17:33:08 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink. ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 13:33:02.357034 2026] [security2:error] [pid 24855:tid 24855] [client 129.222.147.25:12659] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.25 (+1 hits since last alert)\|justicehoward.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "justicehoward.com"] [uri "/xmlrpc.php"] [unique_id "aoiLzlbCsseUNM4y2e6VXwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-08-21 15:59:36 (5 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/customer.nrbiken1.isp.starlink.com	Web App Attack
🇩🇪 rh24	2026-08-21 13:33:10 (5 days ago)	(wordpress) Failed wordpress login from 129.222.147.25 (KE/Kenya/customer.nrbiken1.isp.starlink.com) ... show more (wordpress) Failed wordpress login from 129.222.147.25 (KE/Kenya/customer.nrbiken1.isp.starlink.com): (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-08-21 09:18:41 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink. ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 05:18:35.680575 2026] [security2:error] [pid 7270:tid 7270] [client 129.222.147.25:17900] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.25 (+1 hits since last alert)\|aifactoid.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aifactoid.com"] [uri "/xmlrpc.php"] [unique_id "aogX6yGC21HijNwKIk_djAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-21 08:15:51 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink. ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 04:15:46.624764 2026] [security2:error] [pid 29432:tid 29432] [client 129.222.147.25:6147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.25 (+1 hits since last alert)\|infinityartistsgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "infinityartistsgroup.com"] [uri "/xmlrpc.php"] [unique_id "aogJMltD7T0zlssvhyhNJwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-21 02:56:17 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink. ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.25 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 22:56:13.367991 2026] [security2:error] [pid 7165:tid 7165] [client 129.222.147.25:47123] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.25 (+1 hits since last alert)\|kontikimotorcycles.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "kontikimotorcycles.com"] [uri "/xmlrpc.php"] [unique_id "aoe-TbbD19EnRDrcarRqSgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-08-20 10:41:53 (6 days ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 MPL	2026-08-20 03:59:27 (6 days ago)	tcp/22 (4 or more attempts)	Port Scan
🇺🇸 MPL	2026-08-20 03:59:27 (6 days ago)	tcp/22 (2 or more attempts)	Port Scan
🇺🇸 kosada.com	2026-08-01 10:10:36 (3 weeks ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
Anonymous	2026-07-17 13:27:07 (1 month ago)	denied traffic to a honeypot network. destination port 41259.	Port Scan Hacking
🇩🇪 ghostwarriors	2026-06-30 04:20:16 (1 month ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 200.105.61.169

🇰🇷 175.195.238.137

🇺🇸 130.131.162.132

🇸🇬 45.78.224.19

🇻🇳 42.114.200.199

🇨🇳 218.4.104.66

🇨🇴 201.46.124.0

🇺🇸 198.46.174.168

🇺🇸 173.198.33.49

🇮🇳 168.144.144.243

🇮🇹 151.57.104.162

🇹🇼 111.70.29.130

🇮🇩 103.159.199.43

🇻🇳 103.154.63.62

🇺🇸 47.254.21.155

🇳🇱 45.148.10.151

🇬🇧 35.203.211.62

🇸🇬 8.219.98.53

🇷🇺 5.139.131.116

🇮🇹 4.232.89.182