149.165.154.209
Neutral Activity
There is no recent abuse activity, or the IP address is whitelisted.
Whitelisted IP
Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.
149.165.154.209 is on our whitelist as DarkMouse (https://port194.com/scanning).
- ISP
- Indiana University
- Usage Type
- University/College/School
- ASN
- AS10680
- Hostname(s)
- worker7.cis250324.projects.jetstream-cloud.org
- Domain Name
- iu.edu
- Country
- ๐บ๐ธ United States of America
- City
- Indianapolis, Indiana
Abuse Reports
Total reports
169 from
101 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week.
This IP is on our whitelist as DarkMouse (https://port194.com/scanning).
Shared services like this are often reported for traffic that is not abuse, so review the reports
before blocking.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| ๐บ๐ธ benjensen |
SSH honeypot โ automated credential stuffing and scanning detected by Cowrie honeypot
|
Brute-Force SSH | |
| ๐ฏ๐ต S.O.B.A. Dev. |
Persistent port scanning or vulnerability scanning
|
Port Scan | |
| ๐ต๐ฑ mkey |
Source IP from blacklist is still actively scanning our network. (5 hits in last hour, last seen 2026-11-13 02:53:43)
|
Port Scan | |
| ๐ท๐ธ Scan |
MultiHost/MultiPort Probe, Scan, Hack -
|
Port Scan Hacking | |
| ๐ฆ๐น urnilxfgbez |
Last 24 Hours suspicious: (DPT=445|DPT=3389|DPT=22|DPT=3306|DPT=8080|DPT=23|DPT=5900|DPT=1433)
|
Port Scan | |
| Anonymous |
Repeated unauthorized connection attempts to restricted service observed.
|
Port Scan Hacking Bad Web Bot Web App Attack | |
| ๐ง๐ฌ Ilcheff |
SSH tarpit hit: connection from worker7.cis250324.projects.jetstream-cloud.org [US/United States, AS10680] to SSH accepted.
|
Port Scan Brute-Force SSH | |
| ๐ณ๐ฑ globcom |
Web exploit scanning
|
Web App Attack | |
| Anonymous |
Blocked by firewall on hugin [22/tcp] | Rule: UFW | SPT: 63264 | TTL: 42 | LEN: 52 | TOS: 0x00 โข Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan SSH | |
| ๐บ๐ธ donarev419 |
Connection to port 18080 with data transfer.
Data preview: !๏ฟฝ
|
Port Scan Hacking | |
| ๐บ๐ธ donarev419 |
Connection to port 8080 with data transfer.
Data preview: GET /favicon.ico HTTP/1.1
Host: 167.253.66.144:8080
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
|
Port Scan Hacking | |
| ๐บ๐ธ donarev419 |
Connection to port 80 with data transfer.
Data preview: GET /favicon.ico HTTP/1.1
Host: 167.253.66.144
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Acc
|
Port Scan Hacking | |
| ๐ฎ๐ฉ securejdprop |
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET SCAN Zmap User-Agent (Inbound)).
|
Hacking Web App Attack | |
| ๐บ๐ธ donarev419 |
Connection to port 8080 with data transfer.
Data preview: GET / HTTP/1.1
Host: 167.253.66.144:8080
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-En
|
Port Scan Hacking | |
| ๐บ๐ธ donarev419 |
Connection to port 443 with data transfer.
Data preview:
|
Port Scan Hacking |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown