JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.227.131.216

154.227.131.216 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 63%: ?

63%

ISP	Airtel-Uganda
Usage Type	Fixed Line ISP
ASN	AS37075
Hostname(s)	216-131-227-154.r.airtel.ug
Domain Name	airtel.in
Country	🇺🇬 Uganda
City	Kampala, Central Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.227.131.216

Whois 154.227.131.216

IP Abuse Reports for 154.227.131.216:

This IP address has been reported a total of 19 times from 15 distinct sources. 154.227.131.216 was first reported on March 29th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 WeekendWeb	2026-07-26 19:53:13 (3 hours ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 18:00:33 (5 hours ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 14:00:28.604103 2026] [security2:error] [pid 2831196:tid 2831196] [client 154.227.131.216:32111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.216 (+1 hits since last alert)\|paleopathologist.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "paleopathologist.com"] [uri "/xmlrpc.php"] [unique_id "amZLPPh0xz1yu6bKxhAIOwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-26 17:58:58 (5 hours ago)	Blocked by CSF 13 firewall - Rule: XMLRPC UG/Uganda/216-131-227-154.r.airtel.ug	Web App Attack
🇺🇸 IndigoRidge	2026-07-26 15:49:07 (7 hours ago)	154.227.131.216 - - [26/Jul/2026:11:47:39 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress ... show more 154.227.131.216 - - [26/Jul/2026:11:47:39 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 154.227.131.216 - - [26/Jul/2026:11:48:23 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 154.227.131.216 - - [26/Jul/2026:11:48:45 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 154.227.131.216 - - [26/Jul/2026:11:48:56 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" 154.227.131.216 - - [26/Jul/2026:11:49:07 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5266 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇫🇷 dynamix	2026-07-26 06:26:29 (16 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 Marc	2026-07-26 05:55:06 (17 hours ago)	154.227.131.216 - - [26/Jul/2026:07:54:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4669 "-" "Jetpack b ... show more 154.227.131.216 - - [26/Jul/2026:07:54:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4669 "-" "Jetpack by WordPress.com" 154.227.131.216 - - [26/Jul/2026:07:54:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4671 "-" "WordPress.com; https://wordpress.com" 154.227.131.216 - - [26/Jul/2026:07:55:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4670 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.3)" show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 19:49:17 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 15:49:12.192739 2026] [security2:error] [pid 1368352:tid 1368352] [client 154.227.131.216:29775] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.216 (+1 hits since last alert)\|ardeeapps.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ardeeapps.com"] [uri "/xmlrpc.php"] [unique_id "amUTOHOMEQwPhBEnKhGHKQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 17:15:11 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 13:15:05.717555 2026] [security2:error] [pid 1264:tid 1264] [client 154.227.131.216:16684] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.216 (+1 hits since last alert)\|faithlines.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "faithlines.com"] [uri "/xmlrpc.php"] [unique_id "amTvGfwWseIB_JgR2FGocQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Apache	2026-07-24 14:46:34 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.216 (UG/Uganda/216-131-227-154.r.ai ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.216 (UG/Uganda/216-131-227-154.r.airtel.ug): 5 in the last 300 secs show less	Brute-Force Web App Attack
Anonymous	2026-07-24 14:29:23 (2 days ago)	[redacted] 154.227.131.216 - - [24/Jul/2026:16:28:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" ... show more [redacted] 154.227.131.216 - - [24/Jul/2026:16:28:39 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)" [redacted] 154.227.131.216 - - [24/Jul/2026:16:28:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 154.227.131.216 - - [24/Jul/2026:16:29:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 154.227.131.216 - - [24/Jul/2026:16:29:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/12.5; WordPress/6.2; http://site17514659.com" [redacted] 154.227.131.216 - - [24/Jul/2026:16:29:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 14:00:45 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): ... show more (mod_security) mod_security (id:240335) triggered by 154.227.131.216 (216-131-227-154.r.airtel.ug): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 10:00:37.621594 2026] [security2:error] [pid 691532:tid 691589] [client 154.227.131.216:65430] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 154.227.131.216 (+1 hits since last alert)\|gabegabel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "gabegabel.com"] [uri "/xmlrpc.php"] [unique_id "amNwBQXYMJVQULNPfDrMEAAAAFc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 factor1	2026-07-24 13:26:33 (2 days ago)	Fail2ban at saturn Reports Abuse.	Brute-Force Web App Attack
🇫🇮 KnightIndustries	2026-07-24 12:17:02 (2 days ago)	2026-07-24T14:16:25.916339+02:00 milkyway wordpress(fawcettcomputerservices.com)[476961]: XML-RPC au ... show more 2026-07-24T14:16:25.916339+02:00 milkyway wordpress(fawcettcomputerservices.com)[476961]: XML-RPC authentication failure for joshua from 154.227.131.216 2026-07-24T14:16:49.287511+02:00 milkyway wordpress(fawcettcomputerservices.com)[437327]: XML-RPC authentication failure for joshua from 154.227.131.216 2026-07-24T14:17:01.440302+02:00 milkyway wordpress(fawcettcomputerservices.com)[471194]: XML-RPC authentication failure for joshua from 154.227.131.216 ... show less	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-04-04 17:31:14 (3 months ago)	Try to access /xmlrpc.php	Web App Attack
🇳🇿 Tripwire	2026-04-04 00:01:28 (3 months ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 222.232.176.7

🇹🇼 114.35.59.237

🇨🇳 113.194.1.254

🇮🇩 103.157.63.16

🇫🇷 85.217.140.42

🇺🇦 62.122.202.202

🇻🇳 27.79.47.131

🇮🇪 3.254.181.243

🇧🇷 200.196.50.91

🇳🇱 176.65.149.27

🇦🇹 172.68.50.162

🇺🇸 144.225.8.142

🇨🇳 117.50.70.125

🇷🇺 79.104.0.82

🇮🇪 54.247.212.109

🇳🇱 45.148.10.141

🇺🇸 20.106.206.77

🇩🇪 213.209.159.11

🇸🇬 152.42.235.126

🇫🇮 35.228.41.62