JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.159.237.54

154.159.237.54 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 100%: ?

100%

ISP	Airtel Networks Kenya Limited
Usage Type	Mobile ISP
ASN	AS36926
Hostname(s)	54-237-159-154.r.airtelkenya.com
Domain Name	airtel.in
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.159.237.54

Whois 154.159.237.54

IP Abuse Reports for 154.159.237.54:

This IP address has been reported a total of 44 times from 34 distinct sources. 154.159.237.54 was first reported on February 9th 2023, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-09-19 15:09:50 (1 day ago)	Fail2ban filtered ...	Web App Attack
🇺🇸 Dave Hansen	2026-09-19 12:26:52 (1 day ago)	(wordpress) Failed wordpress login from 154.159.237.54 (KE/Kenya/54-237-159-154.r.airtelkenya.com)	Brute-Force
🇩🇪 Marc	2026-09-19 06:45:34 (1 day ago)	154.159.237.54 - - [19/Sep/2026:08:45:12 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5089 "-" "WordPress. ... show more 154.159.237.54 - - [19/Sep/2026:08:45:12 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5089 "-" "WordPress.com; https://wordpress.com" 154.159.237.54 - - [19/Sep/2026:08:45:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5090 "-" "Jetpack by WordPress.com" 154.159.237.54 - - [19/Sep/2026:08:45:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 5089 "-" "Jetpack by WordPress.com" show less	Brute-Force Web App Attack
🇧🇪 madeit	2026-09-19 04:33:18 (2 days ago)		Web App Attack
🇫🇷 tecnicorioja	2026-09-18 22:00:05 (2 days ago)	POST /xmlrpc.php [18/Sep/2026:13:57:00	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-18 15:18:03 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 154.159.237.54 (54-237-159-154.r.airtelkenya.co ... show more (mod_security) mod_security (id:210350) triggered by 154.159.237.54 (54-237-159-154.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 11:17:55.942258 2026] [security2:error] [pid 14408:tid 14408] [client 154.159.237.54:32388] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|rail-town.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rail-town.com"] [uri "/"] [unique_id "aq1WI7Ok1a1Mk7ii2cLElgAAAAM"], referer: https://backlinkcheckerbest.shop/dir/backlinks-for-google-ranking-171646 show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-09-18 15:10:59 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 LRob	2026-09-18 07:37:56 (2 days ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: POST \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: POST \| path: /xmlrpc.php \| ua: Jetpack/12.5; WordPress/6.2; http://site28528123.com \| 2026-09-18 07:37 UTC show less	Hacking Web App Attack
Anonymous	2026-09-18 05:11:12 (3 days ago)	[redacted] 154.159.237.54 - - [18/Sep/2026:07:10:29 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" " ... show more [redacted] 154.159.237.54 - - [18/Sep/2026:07:10:29 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" [redacted] 154.159.237.54 - - [18/Sep/2026:07:10:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)" [redacted] 154.159.237.54 - - [18/Sep/2026:07:10:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 154.159.237.54 - - [18/Sep/2026:07:11:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "WordPress.com; https://wordpress.com" [redacted] 154.159.237.54 - - [18/Sep/2026:07:11:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 415 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇺🇸 integrantservices.com	2026-09-18 03:58:55 (3 days ago)	(wordpress) Failed wordpress login from 154.159.237.54 (KE/Kenya/54-237-159-154.r.airtelkenya.com)	Brute-Force
🇳🇱 Site.eu	2026-09-18 03:40:07 (3 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-09-17 03:50:27 (4 days ago)	(mod_security) mod_security (id:210350) triggered by 154.159.237.54 (54-237-159-154.r.airtelkenya.co ... show more (mod_security) mod_security (id:210350) triggered by 154.159.237.54 (54-237-159-154.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 23:50:23.977683 2026] [security2:error] [pid 12465:tid 12529] [client 154.159.237.54:17462] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|ptinct.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ptinct.com"] [uri "/"] [unique_id "aqtjfwQXez817wMaDJe96AAAAgQ"], referer: https://websitecheckerseo.online/dir/seo-outreach-backlinks-168558 show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-09-16 15:04:00 (4 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC KE/Kenya/54-237-159-154.r.airtelkenya.com	Web App Attack
🇳🇱 ConsulHosting	2026-09-16 12:16:06 (4 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇮🇹 CoreTech srl	2026-09-16 11:34:09 (4 days ago)	cloudlinux2 fail2ban: 2026-09-16 13:28:43,516 fail2ban.filter [1818]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-09-16 13:28:43,516 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 98.159.233.76 - 2026-09-16 13:28:42cloudlinux2 fail2ban: 2026-09-16 13:29:59,968 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 136.144.19.160 - 2026-09-16 13:29:59cloudlinux2 fail2ban: 2026-09-16 13:30:00,179 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 104.234.19.134 - 2026-09-16 13:29:59cloudlinux2 fail2ban: 2026-09-16 13:30:04,248 fail2ban.filter [1818]: INFO [plesk-wordpress] Found 104.234.19.134 - 2026-09-16 13:30:03cloudlinux2 fail2ban: 2026-09-16 13:30:02,100 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 154.159.237.54 - 2026-09-16 13:30:02cloudlinux2 fail2ban: 2026-09-16 13:30:44,607 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 154.159.237.54 - 2026-09-16 13:30:44cloudlinux2 fail2ban: 2026-09-16 13:31:08,677 fail2ban.filter [1818]: INFO [plesk-modsecurity] Found 105.99.80.37 - 2026-09-16 13:31:0 show less	Web App Attack

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇪 171.25.158.50

🇺🇸 49.51.231.222

🇺🇸 157.230.62.47

🇻🇪 154.27.136.79

🇩🇪 143.244.81.52

🇮🇩 140.213.14.87

🇹🇼 128.14.236.224

🇻🇳 117.4.32.196

🇵🇱 109.205.211.21

🇳🇬 102.88.137.80

🇺🇸 100.53.92.177

🇺🇸 73.110.45.107

🇺🇸 70.21.199.165

🇺🇸 195.184.76.62

🇳🇱 193.29.139.137

🇳🇱 178.16.54.144

🇿🇦 165.165.108.244

🇬🇧 89.37.172.138

🇵🇹 87.196.80.226

🇺🇸 66.132.172.243