JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 150.228.105.54

150.228.105.54 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 45%: ?

45%

ISP	SpaceX Services, Inc.
Usage Type	Fixed Line ISP
ASN	AS14593
Hostname(s)	customer.sfiabgr1.isp.starlink.com
Domain Name	spacex.com
Country	🇮🇶 Iraq
City	Baghdad, Baghdad

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 150.228.105.54

Whois 150.228.105.54

IP Abuse Reports for 150.228.105.54:

This IP address has been reported a total of 56 times from 40 distinct sources. 150.228.105.54 was first reported on December 6th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Vegascosmetics	2026-09-23 10:42:47 (1 day ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: High Priority: %25252F show less	Hacking Exploited Host Web App Attack
🇧🇷 noconex	2026-09-22 18:10:17 (1 day ago)	Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 150.228.10 ... show more Wazuh Alert \| Rule ID: 100199 \| Desc: Suricata: (ET SCAN Potential SSH Scan) detectado de 150.228.105.54 show less	Port Scan Brute-Force SSH
🇫🇷 Sklurk	2026-09-20 00:16:14 (4 days ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-09-14 20:32:09 (1 week ago)	(mod_security) mod_security (id:210350) triggered by 150.228.105.54 (customer.sfiabgr1.isp.starlink. ... show more (mod_security) mod_security (id:210350) triggered by 150.228.105.54 (customer.sfiabgr1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 16:32:02.717027 2026] [security2:error] [pid 12168:tid 12168] [client 150.228.105.54:38610] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|microkerneltechnologies.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "microkerneltechnologies.com"] [uri "/"] [unique_id "aqhZwr1d-BGwcFJpYPkhiAAAABM"], referer: https://five.co.in/redirect.php?ref_host=macanslot138.org show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ByeByte API	2026-08-23 19:27:40 (1 month ago)	Port scan from this IP. Firewall dropped every packet. Targeted UDP ports: 2873. Single burst at 202 ... show more Port scan from this IP. Firewall dropped every packet. Targeted UDP ports: 2873. Single burst at 2026-08-23 19:27 UTC. show less	Port Scan
🇺🇸 gui-ying233	2026-08-23 19:13:35 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
🇫🇷 Zkillu	2026-08-20 15:43:33 (1 month ago)	DDoS flood attack against 31.56.58.0 (2026-08-20 15:38:33 -> 2026-08-20 15:53:33 UTC) targeting AS21 ... show more DDoS flood attack against 31.56.58.0 (2026-08-20 15:38:33 -> 2026-08-20 15:53:33 UTC) targeting AS215599. This IP (AS14593) sent ~5191 packets (0.50 MB) during the attack window. Likely a compromised device (botnet). show less	DDoS Attack Exploited Host
🇫🇷 Zkillu	2026-08-19 21:42:26 (1 month ago)	UDP flood (DDoS) vs AS215599: 90 pkts / 0.13 MB to UDP 8443 across 57 dst IP(s), 2026-08-19 21:46 to ... show more UDP flood (DDoS) vs AS215599: 90 pkts / 0.13 MB to UDP 8443 across 57 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇺🇸 RAP	2026-08-15 20:43:34 (1 month ago)	2026-08-15 20:43:34 UTC Unauthorized activity to TCP port 22. SSH	SSH
🇺🇸 MPL	2026-08-12 08:15:25 (1 month ago)	tcp ports: 22,23 (12 or more attempts)	Port Scan
🇫🇷 Sklurk	2026-08-11 02:40:19 (1 month ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-08-07 06:49:01 (1 month ago)	Web App Attack	Web App Attack
🇩🇪 london2038.com	2026-08-04 05:14:42 (1 month ago)	Connection atttempts against closed TCP ports Aug 4 07:14:28 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x ... show more Connection atttempts against closed TCP ports Aug 4 07:14:28 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=36644 DF PROTO=TCP SPT=46523 DPT=443 WINDOW=1968 RES=0x00 ACK FIN Aug 4 07:14:33 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=36645 DF PROTO=TCP SPT=46523 DPT=443 WINDOW=1968 RES=0x00 ACK FIN Aug 4 07:14:41 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=36646 DF PROTO=TCP SPT=46523 DPT=443 WINDOW=1968 RES=0x00 ACK FIN show less	Port Scan
🇩🇪 london2038.com	2026-08-03 13:58:44 (1 month ago)	Connection atttempts against closed TCP ports Aug 3 15:58:39 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x ... show more Connection atttempts against closed TCP ports Aug 3 15:58:39 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=2111 DF PROTO=TCP SPT=10689 DPT=443 WINDOW=2036 RES=0x00 ACK FIN Aug 3 15:58:40 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=2112 DF PROTO=TCP SPT=10689 DPT=443 WINDOW=2036 RES=0x00 ACK FIN Aug 3 15:58:43 BLOCK SRC=150.228.105.54 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=2113 DF PROTO=TCP SPT=10689 DPT=443 WINDOW=2036 RES=0x00 ACK FIN show less	Port Scan
🇸🇪 NordhTech	2026-07-29 19:00:13 (1 month ago)	More than 3 malicious connection attempts, trying port(s) 3389/tcp, then blocked from services ...	Port Scan Hacking

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 74.7.227.148

🇹🇼 34.80.110.71

🇰🇷 220.127.148.6

🇺🇸 184.186.73.81

🇺🇦 176.103.2.11

🇺🇸 172.212.225.189

🇧🇷 168.232.66.60

🇭🇰 154.221.20.92

🇦🇷 45.229.84.139

🇮🇪 2a05:d018:1d9d:e701:d55c:5a67:a4d5:557a

🇯🇵 203.25.124.69

🇷🇴 193.32.162.25

🇧🇴 181.188.148.74

🇺🇸 136.114.133.193

🇮🇳 122.168.197.138

🇸🇦 84.8.106.91

🇺🇸 65.49.1.202

🇺🇸 3.130.168.2

🇷🇴 2.57.122.168

🇺🇸 2a03:2880:f800:25::