JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 1.85.219.197

1.85.219.197 was found in our database!

This IP was reported 154 times. Confidence of Abuse is 37%: ?

37%

ISP	CHINANET SHAANXI PROVINCE NETWORK
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	xa.sn.cn
Country	🇨🇳 China
City	Xi'an, Shaanxi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 1.85.219.197

Whois 1.85.219.197

IP Abuse Reports for 1.85.219.197:

This IP address has been reported a total of 154 times from 52 distinct sources. 1.85.219.197 was first reported on March 12th 2021, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 CounterScrape	2026-07-02 19:01:15 (9 hours ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-01 18:03:00 (1 day ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
Anonymous	2026-07-01 01:09:55 (2 days ago)	Honeypot hit: Empty payload (likely service probe); 18245 [1] TCP Reported by: https://github.com/se ... show more Honeypot hit: Empty payload (likely service probe); 18245 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇺🇸 CounterScrape	2026-06-30 17:07:21 (2 days ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
Anonymous	2026-06-30 09:32:06 (2 days ago)	Port scan on ports 8112/TCP, 10008/TCP to unused IP	Port Scan
🇫🇮 6kilowatti	2026-06-19 05:19:27 (1 week ago)	2026-06-19T08:19:26.397265+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00: ... show more 2026-06-19T08:19:26.397265+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=1.85.219.197 DST=83.148.240.21 LEN=44 TOS=0x00 PREC=0x00 TTL=236 ID=5376 PROTO=TCP SPT=26723 DPT=888 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 MPL	2026-06-17 15:08:28 (2 weeks ago)	tcp/5999 (2 or more attempts)	Port Scan
🇺🇸 cwytech	2026-06-17 14:30:18 (2 weeks ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tactical-rmm-lockdown-high.	Hacking
🇺🇸 Axel	2026-06-17 10:26:59 (2 weeks ago)	Blocked by UFW on LAXHH [13722/tcp] \| SPT: 25129 \| TTL: 235 \| LEN: 44 \| TOS: 0x00 • Reported by: git ... show more Blocked by UFW on LAXHH [13722/tcp] \| SPT: 25129 \| TTL: 235 \| LEN: 44 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 Axel	2026-06-12 17:53:51 (2 weeks ago)	Blocked by UFW on LAXHH [7537/tcp] \| SPT: 20940 \| TTL: 235 \| LEN: 44 \| TOS: 0x00 • Reported by: gith ... show more Blocked by UFW on LAXHH [7537/tcp] \| SPT: 20940 \| TTL: 235 \| LEN: 44 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 Axel	2026-06-11 23:44:09 (3 weeks ago)	Blocked by UFW on LAXHH [20/tcp] \| SPT: 42048 \| TTL: 235 \| LEN: 44 \| TOS: 0x00 • Reported by: github ... show more Blocked by UFW on LAXHH [20/tcp] \| SPT: 42048 \| TTL: 235 \| LEN: 44 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇬🇧 PeravixGroup	2026-04-24 13:38:30 (2 months ago)	HoneyPot hit - Aaran.cloud \| Memcached Amplification \| amplification attack	Hacking
🇦🇺 trentwiles.com	2026-04-23 22:31:29 (2 months ago)	Unauthorized connection attempt detected from IP address 1.85.219.197 to port 50323 [SYD]	Port Scan
🇺🇸 LSPCCU	2026-04-22 16:48:20 (2 months ago)	TSEC Honeypot Network report. Threat score: 70/100. Categories: Hacking. Honeypot: cowrie, ssh-telne ... show more TSEC Honeypot Network report. Threat score: 70/100. Categories: Hacking. Honeypot: cowrie, ssh-telnet. Context: 1. show less	Hacking
🇺🇸 xmission.com	2026-03-18 13:22:20 (3 months ago)	Blocked by UFW (TCP on 49158) Source port: 17644 TTL: 237 Packet length: 44 TOS: 0x08 This report ( ... show more Blocked by UFW (TCP on 49158) Source port: 17644 TTL: 237 Packet length: 44 TOS: 0x08 This report (for 1.85.219.197) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 154 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 202.88.36.168

🇦🇷 181.164.12.188

🇺🇸 172.239.64.155

🇺🇸 66.132.195.29

🇺🇸 65.49.1.160

🇺🇸 35.153.53.215

🇧🇪 34.38.212.199

🇬🇧 217.146.80.120

🇨🇱 186.10.86.130

🇨🇳 180.171.77.18

🇷🇺 176.195.202.61

🇯🇵 20.243.208.191

🇺🇸 150.107.36.119

🇮🇳 106.219.75.96

🇭🇰 103.210.21.32

🇳🇿 103.75.11.165

🇺🇸 45.194.67.26

🇳🇱 45.148.17.22

🇺🇸 205.210.31.35

🇧🇷 181.232.220.150