JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.227.131.209

154.227.131.209 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 45%: ?

45%

ISP	Airtel-Uganda
Usage Type	Fixed Line ISP
ASN	AS37075
Hostname(s)	209-131-227-154.r.airtel.ug
Domain Name	airtel.in
Country	🇺🇬 Uganda
City	Kampala, Central Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.227.131.209

Whois 154.227.131.209

IP Abuse Reports for 154.227.131.209:

This IP address has been reported a total of 13 times from 9 distinct sources. 154.227.131.209 was first reported on August 2nd 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 dynamix	2026-07-21 09:14:02 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇬🇧 gigatech	2026-07-21 07:55:03 (3 days ago)	Webserver Probing	Web App Attack
🇫🇮 YF	2026-07-21 03:00:23 (3 days ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇺🇸 TPI-Abuse	2026-07-21 00:42:29 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 20:42:25.250646 2026] [security2:error] [pid 16738:tid 16738] [client 154.227.131.209:23014] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.209 (+1 hits since last alert)\|huntingforebears.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "huntingforebears.com"] [uri "/xmlrpc.php"] [unique_id "al7Accnk0G16oDPcGHdwGAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 23:08:49 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 19:08:43.190833 2026] [security2:error] [pid 13992:tid 14011] [client 154.227.131.209:24799] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.209 (+1 hits since last alert)\|managementlaw.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "managementlaw.com"] [uri "/xmlrpc.php"] [unique_id "al6qe2JDwmrzN4tgCZcDhQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BlueWire Hosting	2026-07-20 20:03:42 (3 days ago)	Probing websites for vulnerabilities	Web App Attack
Anonymous	2026-07-20 17:00:19 (3 days ago)	(wordpress) Failed wordpress login from 154.227.131.209 (UG/Uganda/Kampala District/Kampala/209-131- ... show more (wordpress) Failed wordpress login from 154.227.131.209 (UG/Uganda/Kampala District/Kampala/209-131-227-154.r.airtel.ug/[redacted]) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-07-20 15:30:22 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 11:30:18.006154 2026] [security2:error] [pid 1507645:tid 1507645] [client 154.227.131.209:4102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.209 (+1 hits since last alert)\|guarinofurnituredesigns.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "guarinofurnituredesigns.com"] [uri "/xmlrpc.php"] [unique_id "al4_Cqsg-T6CGuRHh_z0RAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 konseptit	2026-07-20 14:57:27 (3 days ago)	(wordpress) Failed wordpress login from 154.227.131.209 (UG/Uganda/209-131-227-154.r.airtel.ug)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-20 10:47:18 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.209 (209-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 06:47:10.624870 2026] [security2:error] [pid 27414:tid 27414] [client 154.227.131.209:24752] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.209 (+1 hits since last alert)\|passy.us\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "passy.us"] [uri "/xmlrpc.php"] [unique_id "al38rucjT3PmLhnEJmQXeAAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 exxos	2025-08-31 13:05:12 (10 months ago)	Attacks with Bad user agents	Hacking
🇳🇱 exxos	2025-08-31 12:03:01 (10 months ago)	http-no-verb	Hacking
🇧🇪 Ivo Vynckier	2024-08-02 14:24:00 (1 year ago)	154.227.131.209 - - [02/Aug/2024:12:15:59 +0200] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5. ... show more 154.227.131.209 - - [02/Aug/2024:12:15:59 +0200] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 154.227.131.209 - - [02/Aug/2024:12:16:00 +0200] "GET /xmlrpc.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" show less	Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 159.65.149.131

🇿🇦 102.39.172.204

🇪🇬 197.50.50.63

🇩🇪 194.13.82.196

🇬🇧 193.32.209.247

🇬🇧 185.247.137.28

🇨🇳 182.61.22.188

🇻🇳 171.243.149.107

🇨🇱 104.239.88.217

🇬🇧 87.236.176.119

🇫🇷 85.217.140.38

🇫🇷 51.254.113.225

🇸🇬 47.236.67.12

🇳🇱 45.156.128.79

🇧🇷 45.70.227.52

🇨🇳 14.153.35.157

🇳🇱 5.61.209.92

🇲🇦 160.178.179.252

🇳🇱 89.248.172.10

🇨🇦 85.217.149.73