JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.160.2.85

154.160.2.85 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 65%: ?

65%

ISP	AS_MOBILE
Usage Type	Mobile ISP
ASN	AS30986
Hostname(s)	dyn-as-mobile-154-160-2-85.mtn.com.gh
Domain Name	mtn.com.gh
Country	🇬🇭 Ghana
City	Accra, Greater Accra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.160.2.85

Whois 154.160.2.85

IP Abuse Reports for 154.160.2.85:

This IP address has been reported a total of 16 times from 12 distinct sources. 154.160.2.85 was first reported on May 12th 2023, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 netclix.gr	2026-07-04 19:48:47 (2 hours ago)	(wordpress) Failed wordpress login from 154.160.2.85 (GH/Ghana/dyn-as-mobile-154-160-2-85.mtn.com.gh ... show more (wordpress) Failed wordpress login from 154.160.2.85 (GH/Ghana/dyn-as-mobile-154-160-2-85.mtn.com.gh): (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-04 17:25:41 (5 hours ago)	(mod_security) mod_security (id:240335) triggered by 154.160.2.85 (dyn-as-mobile-154-160-2-85.mtn.co ... show more (mod_security) mod_security (id:240335) triggered by 154.160.2.85 (dyn-as-mobile-154-160-2-85.mtn.com.gh): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 13:25:37.977461 2026] [security2:error] [pid 8265:tid 8265] [client 154.160.2.85:45088] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.160.2.85 (+1 hits since last alert)\|cuulphotos.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cuulphotos.com"] [uri "/xmlrpc.php"] [unique_id "aklCEWr1iYJKNb689wG-lQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-04 15:06:39 (7 hours ago)	154.160.2.85 - - [04/Jul/2026:17:06:17 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Jetpack by W ... show more 154.160.2.85 - - [04/Jul/2026:17:06:17 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.4)" 154.160.2.85 - - [04/Jul/2026:17:06:27 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)" 154.160.2.85 - - [04/Jul/2026:17:06:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "WordPress.com; https://wordpress.com" show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-04 14:49:46 (7 hours ago)	154.160.2.85 - - [04/Jul/2026:16:49:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "WordPress.co ... show more 154.160.2.85 - - [04/Jul/2026:16:49:26 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "WordPress.com; https://wordpress.com" 154.160.2.85 - - [04/Jul/2026:16:49:35 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" 154.160.2.85 - - [04/Jul/2026:16:49:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 6398 "-" "WordPress.com; https://wordpress.com" show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-03 16:01:39 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 154.160.2.85 (dyn-as-mobile-154-160-2-85.mtn.co ... show more (mod_security) mod_security (id:240335) triggered by 154.160.2.85 (dyn-as-mobile-154-160-2-85.mtn.com.gh): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 12:01:34.317877 2026] [security2:error] [pid 26628:tid 26635] [client 154.160.2.85:20791] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.160.2.85 (+1 hits since last alert)\|ccgparquitectos.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ccgparquitectos.com"] [uri "/xmlrpc.php"] [unique_id "akfc3qFAB-McUEywfqaGwgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-07-03 02:40:45 (1 day ago)	(wordpress) Failed wordpress login from 154.160.2.85 (GH/Ghana/dyn-as-mobile-154-160-2-85.mtn.com.gh ... show more (wordpress) Failed wordpress login from 154.160.2.85 (GH/Ghana/dyn-as-mobile-154-160-2-85.mtn.com.gh) show less	Brute-Force
🇺🇸 bigwavedave	2026-07-02 13:03:40 (2 days ago)	Wordpress Attack	Web App Attack
🇪🇸 masterguru	2026-07-02 11:04:40 (2 days ago)	(xmlrpc) Failed xmlrpc access from 154.160.2.85 (GH/Ghana/dyn-as-mobile-154-160-2-85.mtn.com.gh): 5 ... show more (xmlrpc) Failed xmlrpc access from 154.160.2.85 (GH/Ghana/dyn-as-mobile-154-160-2-85.mtn.com.gh): 5 in the last 3600 secs (0-122) show less	Hacking
🇬🇧 poundawebsiteltd	2026-07-02 04:31:22 (2 days ago)	WP Exploit attempt. Evidence: beanietools.dev:443 154.160.2.85 - - [02/Jul/2026:05:31:19 +0100] POST ... show more WP Exploit attempt. Evidence: beanietools.dev:443 154.160.2.85 - - [02/Jul/2026:05:31:19 +0100] POST /xmlrpc.php HTTP/1.1 503 22714 - Jetpack by [REDACTED_DOMAIN] (Jetpack 12.1; WordPress 6.3) show less	Web App Attack
🇫🇷 dynamix	2026-07-02 00:12:38 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇫🇮 YF	2026-07-01 23:00:29 (2 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
Anonymous	2026-06-26 08:13:28 (1 week ago)		Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 07:59:36 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 154.160.2.85 (dyn-as-mobile-154-160-2-85.mtn.co ... show more (mod_security) mod_security (id:225170) triggered by 154.160.2.85 (dyn-as-mobile-154-160-2-85.mtn.com.gh): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 03:59:29.640868 2026] [security2:error] [pid 15295:tid 15295] [client 154.160.2.85:26252] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|swcbsa.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "swcbsa.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aj4xYWZcAxgwkVvwyLZmfQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-26 05:06:05 (1 week ago)	Trying to access config files	Web App Attack
🇫🇷 dynamix	2026-06-25 21:13:24 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 193.56.116.35

🇧🇷 185.100.215.213

🇩🇪 178.104.53.168

🇸🇬 161.118.195.148

🇨🇳 120.239.28.221

🇮🇹 93.92.79.120

🇸🇬 47.237.124.132

🇩🇿 41.111.178.165

🇧🇷 205.210.31.253

🇯🇵 203.25.124.187

🇺🇸 173.239.254.236

🇻🇳 171.244.39.95

🇻🇳 125.212.244.35

🇧🇬 78.128.114.58

🇺🇸 40.124.175.52

🇮🇩 36.92.41.115

🇫🇷 185.177.72.54

🇺🇸 164.90.152.103

🇩🇿 154.243.213.104

🇺🇸 104.37.190.51