JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 41.90.167.149

41.90.167.149 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 35%: ?

35%

ISP	Safaricom Limited
Usage Type	Fixed Line ISP
ASN	AS37061
Hostname(s)	41-90-167-149.safaricombusiness.co.ke
Domain Name	safaricom.co.ke
Country	🇰🇪 Kenya
City	Nairobi, Nairobi County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 41.90.167.149

Whois 41.90.167.149

IP Abuse Reports for 41.90.167.149:

This IP address has been reported a total of 48 times from 31 distinct sources. 41.90.167.149 was first reported on September 17th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2026-05-13 01:35:32 (3 weeks ago)	ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/41.90.167.149	SSH
🇺🇸 TPI-Abuse	2026-05-12 09:51:34 (3 weeks ago)	(mod_security) mod_security (id:217210) triggered by 41.90.167.149 (41-90-167-149.safaricombusiness. ... show more (mod_security) mod_security (id:217210) triggered by 41.90.167.149 (41-90-167-149.safaricombusiness.co.ke): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 05:51:27.657645 2026] [security2:error] [pid 14648:tid 14648] [client 41.90.167.149:52388] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|blog33movie.shop\|F\|4"] [data "GET http://blog33movie.shop HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "blog33movie.shop"] [uri "/"] [unique_id "agL4H74jlnJ8PzBc_u8V5AAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 PeravixGroup	2026-05-11 18:07:44 (3 weeks ago)	Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: ME ... show more Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud show less	IoT Targeted Brute-Force
🇺🇸 RAP	2026-05-11 17:05:51 (3 weeks ago)	2026-05-11 17:05:51 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇺🇸 MPL	2026-05-11 17:01:36 (3 weeks ago)	tcp/23	Port Scan
🇩🇪 _ArminS_	2026-05-11 16:50:09 (3 weeks ago)	SP-Scan 12924:23 detected 2026.05.11 18:50:09 blocked until 2026.06.30 11:52:56	Port Scan
🇺🇸 RAP	2026-05-07 21:48:50 (4 weeks ago)	2026-05-07 21:48:50 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇵🇱 mkey	2026-05-06 09:30:03 (4 weeks ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS ... show more Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=23 \| HITS=2 \| IPSET=ADD \| FIRST=2026-05-06 11:27:36 \| LAST=2026-05-06 11:27:37. Last seen 2026-05-06 11:27:37. show less	Port Scan
🇳🇱 VMHeaven.io	2026-05-06 07:54:18 (4 weeks ago)	Blocked by UFW [23/tcp] Source port: 36218 TTL: 52 Packet length: 60	Port Scan Hacking Brute-Force
🇺🇸 kosada.com	2026-04-15 12:14:38 (1 month ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-03-27 11:10:39 (2 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 COMPLEX	2026-03-17 18:26:54 (2 months ago)	Triggered Cloudflare WAF (l7ddos) from KE. Action taken: MANAGED_CHALLENGE ASN: undefined (undefined ... show more Triggered Cloudflare WAF (l7ddos) from KE. Action taken: MANAGED_CHALLENGE ASN: undefined (undefined) Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0 show less	DDoS Attack Bad Web Bot
🇧🇪 cmbplf	2026-02-21 18:20:14 (3 months ago)	936 limiting connections by zone (9m59s)	DDoS Attack
Anonymous	2026-02-15 09:36:01 (3 months ago)	41.90.167.149 - - [15/Feb/2026:10:36:01 +0100] "GET https://www/product/weider-classic-shaker-700ml/ ... show more 41.90.167.149 - - [15/Feb/2026:10:36:01 +0100] "GET https://www/product/weider-classic-shaker-700ml/ HTTP/1.1" 404 44185 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SE 2.X MetaSr 1.0; SE 2.X MetaSr 1.0; .NET CLR 2.0.50727; SE 2.X MetaSr 1.0)" show less	Hacking
🇩🇪 dewoda	2026-01-17 12:25:30 (4 months ago)	Blocked by UFW on htzded01 [2323/tcp] Source port: 51220 TTL: 52 Packet length: 60 TOS: 0x00 This r ... show more Blocked by UFW on htzded01 [2323/tcp] Source port: 51220 TTL: 52 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan IoT Targeted

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.136.15.12

🇭🇰 119.246.15.94

🇰🇷 221.156.126.1

🇺🇸 192.169.232.63

🇺🇾 186.55.188.83

🇮🇩 124.40.252.3

🇰🇿 45.143.88.46

🇷🇴 2.57.122.238

🇷🇺 80.69.186.68

🇺🇸 66.132.224.26

🇺🇸 45.58.52.25

🇦🇪 20.203.102.60

🇺🇸 20.64.105.148

🇷🇴 2.57.121.25

🇻🇳 183.91.186.36

🇸🇪 172.217.19.227

🇻🇳 103.186.101.237

🇮🇹 95.250.241.71

🇧🇷 45.172.162.153

🇹🇷 45.158.14.124