JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.0.153.9

154.0.153.9 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 59%: ?

59%

ISP	Habari Node Public Limited
Usage Type	Fixed Line ISP
ASN	AS36909
Hostname(s)	host-154.0.153-9.habari.co.tz
Domain Name	habari.co.tz
Country	🇹🇿 Tanzania, the United Republic of
City	Mwanza, Mwanza

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.0.153.9

Whois 154.0.153.9

IP Abuse Reports for 154.0.153.9:

This IP address has been reported a total of 32 times from 20 distinct sources. 154.0.153.9 was first reported on September 27th 2025, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-23 14:04:53 (15 hours ago)	(mod_security) mod_security (id:240335) triggered by 154.0.153.9 (host-154.0.153-9.habari.co.tz): 1 ... show more (mod_security) mod_security (id:240335) triggered by 154.0.153.9 (host-154.0.153-9.habari.co.tz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 10:04:47.912990 2026] [security2:error] [pid 2427002:tid 2427002] [client 154.0.153.9:24851] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.0.153.9 (+1 hits since last alert)\|arriagarealestate.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "arriagarealestate.com"] [uri "/xmlrpc.php"] [unique_id "amIff9jOZDPcGRfE-TubVgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-16 22:24:35 (1 week ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-11 13:20:26 (1 week ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-11 13:04:09 (1 week ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-09 16:29:55 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-09 13:48:42 (2 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-07-09 13:48:02 (2 weeks ago)	[redacted] 154.0.153.9 - - [09/Jul/2026:15:47:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jet ... show more [redacted] 154.0.153.9 - - [09/Jul/2026:15:47:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" [redacted] 154.0.153.9 - - [09/Jul/2026:15:47:27 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.1; WordPress/6.2; http://site43748611.com" [redacted] 154.0.153.9 - - [09/Jul/2026:15:47:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)" [redacted] 154.0.153.9 - - [09/Jul/2026:15:47:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 154.0.153.9 - - [09/Jul/2026:15:48:01 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 16:18:59 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 154.0.153.9 (host-154.0.153-9.habari.co.tz): 1 ... show more (mod_security) mod_security (id:240335) triggered by 154.0.153.9 (host-154.0.153-9.habari.co.tz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 12:18:55.675995 2026] [security2:error] [pid 18620:tid 18620] [client 154.0.153.9:59951] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.0.153.9 (+1 hits since last alert)\|disio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "disio.com"] [uri "/xmlrpc.php"] [unique_id "ak54b5QTJytTDydyMKVBkwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 NotCool	2026-07-08 15:54:55 (2 weeks ago)	(XMLRPC) WP XMLPRC Attack 154.0.153.9 (TZ/Tanzania/host-154.0.153-9.habari.co.tz): 50 in the last 36 ... show more (XMLRPC) WP XMLPRC Attack 154.0.153.9 (TZ/Tanzania/host-154.0.153-9.habari.co.tz): 50 in the last 3600 secs show less	Web App Attack
🇫🇷 masterguru	2026-07-08 14:44:51 (2 weeks ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇺🇸 TPI-Abuse	2026-07-08 07:55:37 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 154.0.153.9 (host-154.0.153-9.habari.co.tz): 1 ... show more (mod_security) mod_security (id:240335) triggered by 154.0.153.9 (host-154.0.153-9.habari.co.tz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 03:55:29.965463 2026] [security2:error] [pid 10758:tid 10758] [client 154.0.153.9:65064] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.0.153.9 (+1 hits since last alert)\|varnadorefamily.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "varnadorefamily.com"] [uri "/xmlrpc.php"] [unique_id "ak4CcSMtdeB9767O4nhk4AAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-07 14:33:37 (2 weeks ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Excessive filters used: /catalogsearch/result/?cat=19&mode=grid&q=Extron+HDMI+101+Plus&stock=1 \| UA: Mozilla/5.0 (Windows NT 5.1; nds-NL; rv:1.9.2.20) Gecko/5269-07-12 22:46:59.495605 Firefox/15.0 \| (Magento Site) show less	Hacking Bad Web Bot
🇳🇱 debestelapp	2026-07-06 16:35:05 (2 weeks ago)		Web App Attack
🇫🇷 dynamix	2026-07-06 14:06:25 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇫🇷 dynamix	2026-07-05 09:20:51 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 193.163.125.229

🇺🇸 64.225.17.153

🇨🇳 61.146.163.63

🇺🇸 34.194.14.255

🇨🇳 14.134.71.78

🇬🇧 195.96.139.52

🇺🇸 166.62.35.226

🇺🇸 162.216.150.47

🇺🇸 130.131.162.184

🇵🇰 111.92.157.216

🇫🇷 91.231.89.170

🇺🇸 91.230.73.65

🇵🇹 89.153.125.230

🇮🇷 79.175.176.177

🇺🇸 74.82.47.45

🇬🇧 51.89.129.215

🇺🇸 45.194.67.120

🇺🇸 34.220.217.151

🇧🇪 198.235.24.218

🇨🇳 192.140.185.8