JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.159.254.29

154.159.254.29 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 22%: ?

22%

ISP	Airtel Networks Kenya Limited
Usage Type	Mobile ISP
ASN	AS36926
Hostname(s)	29-254-159-154.r.airtelkenya.com
Domain Name	airtel.in
Country	🇰🇪 Kenya
City	Mombasa, Mombasa County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.159.254.29

Whois 154.159.254.29

IP Abuse Reports for 154.159.254.29:

This IP address has been reported a total of 32 times from 19 distinct sources. 154.159.254.29 was first reported on December 24th 2024, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 bmino.pl	2026-10-03 20:03:57 (3 weeks ago)	Autoban IP(2): 154.159.254.29 - Hostname: Airtel KE Mobile Broadband - City: Mombasa - Country: Keny ... show more Autoban IP(2): 154.159.254.29 - Hostname: Airtel KE Mobile Broadband - City: Mombasa - Country: Kenya - Organization: AS36926 Airtel Networks Kenya Limited - Reason: GET /?i=ddo61a24335mzenyndgvl HTTP/1.1 show less	Web App Attack
🇺🇸 鬼影233	2026-09-24 15:35:29 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 10:54:54 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 06:10:49 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-20 17:15:59 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇫🇮 saamkuu	2026-09-18 05:41:48 (1 month ago)	DDoS botnet: TCP connection flood, 57 connections to port 443.	DDoS Attack
🇺🇸 TPI-Abuse	2026-09-17 01:15:27 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 154.159.254.29 (29-254-159-154.r.airtelkenya.co ... show more (mod_security) mod_security (id:210350) triggered by 154.159.254.29 (29-254-159-154.r.airtelkenya.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 21:15:20.154623 2026] [security2:error] [pid 23428:tid 23453] [client 154.159.254.29:24631] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.dwcmachining.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.dwcmachining.com"] [uri "/"] [unique_id "aqs_KOkLvlMBfWzbwgfECQAAARc"], referer: https://five.co.in/redirect.php?ref_host=doctor40.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-12 16:41:33 (1 month ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇺🇸 windowsforum	2026-09-03 05:12:27 (1 month ago)	Spam bot SSO registration: triggers=sso_service_check, username=SMART	Web Spam Bad Web Bot
🇺🇸 kosada.com	2026-08-27 05:30:12 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-08-12 11:17:10 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 Vegascosmetics	2026-08-07 20:52:27 (2 months ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected show less	Hacking Exploited Host Web App Attack
🇩🇪 LRob	2026-08-06 15:32:30 (2 months ago)	CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'T ... show more CrowdSec: REPEAT OFFENDER (previously banned, came back) - distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS \| req: /calendrier-2/action~agenda/time_limit~1763506800/cat_ids~172,432,158/tag_ids~636,455,438,791,728/request_format~json/ \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 show less	DDoS Attack Web App Attack
🇩🇪 LRob	2026-08-03 13:45:32 (2 months ago)	CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_forma ... show more CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS \| req: /calendrier-2/action~agenda/page_offset~1/time_limit~1764370800/cat_ids~134,289/tag_ids~655,472,234,451,539,540,582,583/request_format~json/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 show less	DDoS Attack Web App Attack
🇺🇸 kosada.com	2026-08-01 08:53:09 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 185.230.216.5

🇺🇸 172.190.220.228

🇺🇸 144.126.141.210

🇨🇳 118.196.23.226

🇮🇩 103.165.227.178

🇷🇺 91.185.39.130

🇰🇷 59.152.168.184

🇨🇳 47.109.95.201

🇺🇸 216.25.90.105

🇲🇽 187.243.213.121

🇪🇨 181.211.35.45

🇵🇱 83.168.110.192

🇬🇧 78.153.140.237

🇨🇳 47.108.55.70

🇺🇸 20.102.98.53

🇪🇸 212.30.33.147

🇬🇧 167.71.142.53

🇧🇩 103.159.2.113

🇬🇺 103.112.0.20

🇮🇶 65.20.175.6