JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.159.252.133

154.159.252.133 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 22%: ?

22%

ISP	Airtel Networks Kenya Limited
Usage Type	Mobile ISP
ASN	AS36926
Hostname(s)	133-252-159-154.r.airtelkenya.com
Domain Name	airtel.in
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.159.252.133

Whois 154.159.252.133

IP Abuse Reports for 154.159.252.133:

This IP address has been reported a total of 20 times from 11 distinct sources. 154.159.252.133 was first reported on September 25th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-18 22:53:14 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 154.159.252.133 (133-252-159-154.r.airtelkenya. ... show more (mod_security) mod_security (id:240335) triggered by 154.159.252.133 (133-252-159-154.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 18:53:07.957066 2026] [security2:error] [pid 16184:tid 16184] [client 154.159.252.133:29718] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.159.252.133 (+1 hits since last alert)\|rodandreelpiercam.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "rodandreelpiercam.com"] [uri "/xmlrpc.php"] [unique_id "ajR206p2G6_F9UVgrYsu9gAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 20:52:38 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 154.159.252.133 (133-252-159-154.r.airtelkenya. ... show more (mod_security) mod_security (id:240335) triggered by 154.159.252.133 (133-252-159-154.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 16:52:31.602591 2026] [security2:error] [pid 7070:tid 7070] [client 154.159.252.133:7945] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.159.252.133 (+1 hits since last alert)\|iostation.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "iostation.com"] [uri "/xmlrpc.php"] [unique_id "ajRajyDxffsch7fu6NRSKwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 18:48:44 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 154.159.252.133 (133-252-159-154.r.airtelkenya. ... show more (mod_security) mod_security (id:240335) triggered by 154.159.252.133 (133-252-159-154.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 14:48:38.256669 2026] [security2:error] [pid 10940:tid 10940] [client 154.159.252.133:26900] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.159.252.133 (+1 hits since last alert)\|capriexpress.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "capriexpress.com"] [uri "/xmlrpc.php"] [unique_id "ajQ9hpEspreEox9j3oEzDQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇴 SpamStopper	2026-06-18 18:45:10 (1 day ago)	Automated mitigation by Fail2Ban firewall due to persistent security policy violations.	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-22 12:52:47 (4 weeks ago)	Attac	Brute-Force
🇬🇧 PeravixGroup	2026-05-06 16:37:05 (1 month ago)	Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: ME ... show more Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud show less	IoT Targeted Brute-Force
Anonymous	2026-02-23 14:52:39 (3 months ago)	scanning http requests from known botnet	Web App Attack
🇮🇹 VHosting	2025-12-21 14:03:05 (5 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 TPI-Abuse	2025-12-10 14:52:11 (6 months ago)	"Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized ac ... show more "Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized access" show less	DDoS Attack SQL Injection Exploited Host
Anonymous	2025-12-10 13:23:52 (6 months ago)	Malicious activity detected	Hacking Web App Attack
Anonymous	2025-11-17 15:33:07 (7 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-08-20 12:02:30 (10 months ago)	Web attack	Bad Web Bot Web App Attack
🇳🇱 exxos	2025-08-01 02:58:03 (10 months ago)	HTTP1.x attacks	DDoS Attack
🇳🇱 exxos	2025-07-31 03:24:56 (10 months ago)	http-no-verb	Hacking
🇳🇱 exxos	2025-07-31 02:08:55 (10 months ago)	HTTP1.x attacks	DDoS Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 192.210.167.184

🇳🇱 176.65.139.88

🇺🇸 172.58.250.220

🇵🇭 119.92.70.82

🇻🇳 113.182.27.141

🇳🇱 91.92.40.12

🇩🇪 87.106.245.167

🇧🇷 45.205.1.76

🇮🇳 45.112.243.25

🇮🇳 217.216.59.228

🇧🇴 181.115.211.171

🇺🇸 141.11.88.20

🇻🇳 116.99.168.60

🇨🇳 113.214.18.234

🇮🇩 110.139.127.92

🇺🇸 100.50.17.159

🇺🇸 45.56.83.149

🇿🇦 41.123.5.52

🇺🇸 20.98.140.180

🇨🇦 4.239.240.98