JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 129.222.147.254

129.222.147.254 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 53%: ?

53%

ISP	SpaceX Services, Inc.
Usage Type	Fixed Line ISP
ASN	AS14593
Hostname(s)	customer.nrbiken1.isp.starlink.com
Domain Name	spacex.com
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 129.222.147.254

Whois 129.222.147.254

IP Abuse Reports for 129.222.147.254:

This IP address has been reported a total of 19 times from 13 distinct sources. 129.222.147.254 was first reported on December 19th 2024, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-07-03 22:26:22 (21 hours ago)		Brute-Force Web App Attack
🇺🇸 kosada.com	2026-07-03 10:10:28 (1 day ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-03 07:46:36 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.254 (customer.nrbiken1.isp.starlink ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.254 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 03:46:31.730952 2026] [security2:error] [pid 25756:tid 25756] [client 129.222.147.254:33448] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.254 (+1 hits since last alert)\|webuychesterfieldhouses.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "webuychesterfieldhouses.com"] [uri "/xmlrpc.php"] [unique_id "akdo1zjVva5EatdpgjEYGQAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-02 22:26:21 (1 day ago)		Brute-Force Web App Attack
Anonymous	2026-07-02 14:32:40 (2 days ago)	Attac	Brute-Force
🇨🇿 huginet	2026-07-02 12:48:40 (2 days ago)	129.222.147.254 - - [02/Jul/2026:14:48:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "WordPress. ... show more 129.222.147.254 - - [02/Jul/2026:14:48:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "WordPress.com; https://wordpress.com" 129.222.147.254 - - [02/Jul/2026:14:48:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 416 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" ... show less	Web Spam Blog Spam Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 12:19:52 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.254 (customer.nrbiken1.isp.starlink ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.254 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 08:19:48.908408 2026] [security2:error] [pid 11777:tid 11777] [client 129.222.147.254:35799] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.254 (+1 hits since last alert)\|plazahacienda.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "plazahacienda.com"] [uri "/xmlrpc.php"] [unique_id "akZXZGFkuDzTnmwwBIKeIgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-02 08:28:54 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 07:12:29 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 129.222.147.254 (customer.nrbiken1.isp.starlink ... show more (mod_security) mod_security (id:240335) triggered by 129.222.147.254 (customer.nrbiken1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 03:12:23.593132 2026] [security2:error] [pid 8110:tid 8110] [client 129.222.147.254:28520] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 129.222.147.254 (+1 hits since last alert)\|drwolberg.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "drwolberg.com"] [uri "/xmlrpc.php"] [unique_id "akYPV8EkYKtc8E3HHx5UYAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-06-20 07:23:34 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 Vegascosmetics	2026-06-11 08:42:32 (3 weeks ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇩🇪 pltcldvlpr	2026-06-07 10:41:51 (3 weeks ago)	Bogus Useragent: 129.222.147.254 - - [07/Jun/2026:12:41:50 +0200] "GET /protocol?id=th_5_158&paragra ... show more Bogus Useragent: 129.222.147.254 - - [07/Jun/2026:12:41:50 +0200] "GET /protocol?id=th_5_158&paragraph=15563822&seq=865 HTTP/1.1" 444 0 "-" "Opera/8.40.(Windows NT 5.2; tr-TR) Presto/2.9.184 Version/12.00" asn=14593 org="Space Exploration Technologies Corporation" country=KE ... show less	Bad Web Bot
Anonymous	2026-06-03 07:46:48 (1 month ago)		DNS Compromise DDoS Attack
🇯🇵 SentinalX by uzumaru	2026-06-03 07:14:43 (1 month ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: 23.239.9.178:80 show less	Open Proxy Port Scan
🇨🇿 lp	2026-04-13 10:50:52 (2 months ago)	Email account brute force: 2 attempts were recorded from 129.222.147.254 2026-04-13T11:22:16+02:00 w ... show more Email account brute force: 2 attempts were recorded from 129.222.147.254 2026-04-13T11:22:16+02:00 warning: unknown[129.222.147.254]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-04-13T11:22:16+02:00 warning: unknown[129.222.147.254]: SASL LOGIN authentication failed: authentication failure, [email protected] show less	Brute-Force

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.217.54.130

🇨🇳 125.124.183.254

🇮🇩 103.165.139.145

🇸🇬 52.237.126.164

🇳🇱 45.156.128.165

🇳🇱 185.226.197.60

🇺🇸 167.71.26.22

🇨🇳 123.191.156.209

🇵🇭 119.92.70.82

🇰🇪 102.210.149.105

🇬🇧 45.133.173.107

🇨🇳 39.152.118.160

🇬🇪 2.57.217.229

🇬🇧 2a06:4880:2000::38

🇺🇸 207.46.13.87

🇮🇳 202.153.46.43

🇧🇷 200.6.140.126

🇷🇺 186.246.4.15

🇺🇸 172.174.200.225

🇮🇳 167.71.232.235