JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 41.209.3.164

41.209.3.164 was found in our database!

This IP was reported 105 times. Confidence of Abuse is 36%: ?

36%

ISP	MTN Business Kenya
Usage Type	Fixed Line ISP
ASN	AS9129
Domain Name	mtnbusiness.co.ke
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 41.209.3.164

Whois 41.209.3.164

IP Abuse Reports for 41.209.3.164:

This IP address has been reported a total of 105 times from 56 distinct sources. 41.209.3.164 was first reported on November 26th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-25 04:33:47 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 00:33:43.556690 2026] [security2:error] [pid 60539:tid 60539] [client 41.209.3.164:51868] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|rocketfuelpartners.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rocketfuelpartners.com"] [uri "/"] [unique_id "arX5p8k0_YDS7wAfxb3MBAAAAA0"], referer: https://websitesseochecker.space/dir/professional-seo-backlinks-177994 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-24 21:16:41 (3 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 11:30:28 (3 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-22 07:42:14 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 edgeshield	2026-09-21 18:37:36 (3 weeks ago)	Automated web request flooding / DDoS (EdgeShield WAF).	DDoS Attack
🇺🇸 鬼影233	2026-09-19 08:43:27 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-18 17:03:33 (4 weeks ago)	(mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 13:03:28.578110 2026] [security2:error] [pid 21341:tid 21341] [client 41.209.3.164:34130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|drainpoultry.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "drainpoultry.com"] [uri "/"] [unique_id "aq1u4FEjb4hS6qNnfrUsqwAAABE"], referer: https://backlinkcheckerbest.online/dir/trusted-seo-backlinks-58304 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 12:37:31 (4 weeks ago)	(mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 08:37:23.302746 2026] [security2:error] [pid 17313:tid 17313] [client 41.209.3.164:49498] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.tgaguide.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.tgaguide.com"] [uri "/"] [unique_id "aqvfA6OMtx9NwLz1EfyqYQAAAAY"], referer: https://blogdachecker.space/dir/quality-backlink-services-206866 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 05:23:06 (4 weeks ago)	(mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 41.209.3.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 01:23:02.696187 2026] [security2:error] [pid 16752:tid 16765] [client 41.209.3.164:54778] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|pilargarciamanzanares.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "pilargarciamanzanares.com"] [uri "/politica-de-cookies/"] [unique_id "aqt5Nnz5Ot6XLdiMMwHTsgAAAMs"], referer: https://pilargarciamanzanares.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-09-15 18:57:09 (1 month ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB repu ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB reputation policy (no URL signature). Evidence: Suspicion-Ban (Score 65>=65, Abuse 61, NonEU, first-seen, Change* path) show less	Hacking Exploited Host Web App Attack
🇺🇸 鬼影233	2026-09-12 21:02:35 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 LRob	2026-09-12 20:51:19 (1 month ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: /contact \| 2026-09-12 20:51 UTC show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-09 11:11:46 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-09-07 08:47:07 (1 month ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A524&f%5B1%5D=digest_key_terms%3A530&f%5B2%5D=digest_key_terms%3A786&field_article_edition%5B504%5D=504&field_key_terms%5B329%5D=329 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0") show less	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-09-06 18:14:07 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot

Showing 1 to 15 of 105 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 34.107.81.0

🇺🇸 199.165.159.66

🇳🇱 185.107.80.93

🇺🇸 156.232.13.246

🇸🇬 136.85.7.70

🇺🇸 71.233.188.249

🇺🇸 67.225.163.171

🇺🇸 66.132.224.80

🇸🇬 52.237.80.79

🇮🇩 36.75.154.210

🇺🇸 20.124.84.235

🇹🇼 198.235.24.45

🇳🇱 195.178.110.228

🇺🇸 162.216.150.80

🇺🇸 162.216.149.125

🇦🇷 153.67.15.140

🇺🇸 136.80.107.113

🇰🇷 106.244.120.37

🇩🇪 94.183.174.95

🇺🇸 91.230.168.233