JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 211.253.197.83

211.253.197.83 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 51%: ?

51%

ISP	Korea Telecom
Usage Type	Fixed Line ISP
ASN	AS4766
Domain Name	kt.com
Country	🇰🇷 Korea (the Republic of)
City	Andong, Gyeongsangbuk-do

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 211.253.197.83

Whois 211.253.197.83

IP Abuse Reports for 211.253.197.83:

This IP address has been reported a total of 22 times from 20 distinct sources. 211.253.197.83 was first reported on April 3rd 2026, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 honeypot222	2026-09-18 17:42:09 (20 hours ago)	Automated report from an IoT honeypot. 8 malicious events across 1 connections between 2026-09-18 17 ... show more Automated report from an IoT honeypot. 8 malicious events across 1 connections between 2026-09-18 17:42:01 and 2026-09-18 17:42:09 UTC. Services targeted: ssh. Destination ports: 22. Credential brute-force attempts, e.g. admin/admin, admin/<empty>. show less	Brute-Force SSH
🇩🇪 formality	2026-09-18 10:31:43 (1 day ago)	Invalid user admin from 211.253.197.83 port 55868	Brute-Force SSH
🇦🇺 bret.dk	2026-09-18 07:14:16 (1 day ago)	Sep 18 07:14:13 au-mirror sshd[2458078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ... show more Sep 18 07:14:13 au-mirror sshd[2458078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.197.83 Sep 18 07:14:15 au-mirror sshd[2458078]: Failed password for invalid user telecomadmin from 211.253.197.83 port 55994 ssh2 ... show less	Brute-Force SSH
🇫🇮 Nornes	2026-09-18 01:26:23 (1 day ago)	2026-09-18T03:26:20.491357 CentOS-90-stream-amd64-base sshd[1246166]: pam_unix(sshd:auth): authentic ... show more 2026-09-18T03:26:20.491357 CentOS-90-stream-amd64-base sshd[1246166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.197.83 2026-09-18T03:26:22.257834 CentOS-90-stream-amd64-base sshd[1246166]: Failed password for invalid user ubnt from 211.253.197.83 port 56100 ssh2 ... show less	Brute-Force SSH
🇰🇷 2048	2026-09-11 06:32:17 (1 week ago)	SSH credential brute-force observed by honeypot. Source IP: 211.253.197.83 Targeted device: DVR Firs ... show more SSH credential brute-force observed by honeypot. Source IP: 211.253.197.83 Targeted device: DVR First seen: 11 Sep 2026 06:32:17 UTC Last seen: 11 Sep 2026 06:32:17 UTC Attempts: 1 Client: SSH-2.0-Go Sample credentials: admin:admin show less	Brute-Force SSH IoT Targeted
🇺🇸 swalluw	2026-09-08 10:41:42 (1 week ago)	SSH brute-force: 3 failed login attempts in 3s (last 2026-09-08T10:41:42+00:00); usernames tried: ub ... show more SSH brute-force: 3 failed login attempts in 3s (last 2026-09-08T10:41:42+00:00); usernames tried: ubnt show less	Brute-Force SSH
🇺🇸 hl.admin	2026-09-07 01:48:12 (1 week ago)	Fail2ban automatic: sshd, 2 attempts in 24h, Likely: Bruteforce, Logs: 2026-09-07T01:48:10.027225+00 ... show more Fail2ban automatic: sshd, 2 attempts in 24h, Likely: Bruteforce, Logs: 2026-09-07T01:48:10.027225+00:00 HephaestusLabs sshd[3305088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.197.83 2026-09-07T01:48:12.266613+00:00 HephaestusLabs sshd[3305088]: Failed password for invalid user admin from 211.253.197.83 port 44552 ssh2 ... show less	Brute-Force SSH
🇨🇦 DRI	2026-08-21 01:04:56 (4 weeks ago)	Web attack/Malicious activity detected	Web App Attack
🇨🇦 DRI	2026-08-18 04:29:55 (1 month ago)	Web attack/Malicious activity detected	Web App Attack
🇮🇹 CoreTech srl	2026-08-16 03:58:56 (1 month ago)	cloudlinux2 fail2ban: 2026-08-16 05:54:30,042 fail2ban.filter [1791]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-16 05:54:30,042 fail2ban.filter [1791]: INFO [plesk-modsecurity] Found 172.70.142.97 - 2026-08-16 05:54:30cloudlinux2 fail2ban: 2026-08-16 05:54:30,022 fail2ban.filter [1791]: INFO [plesk-modsecurity] Found 172.70.142.97 - 2026-08-16 05:54:30cloudlinux2 fail2ban: 2026-08-16 05:55:08,876 fail2ban.filter [1791]: INFO [plesk-wordpress] Found 58.252.236.66 - 2026-08-16 05:55:08cloudlinux2 fail2ban: 2026-08-16 05:55:06,902 fail2ban.filter [1791]: INFO [plesk-modsecurity] Found 58.252.236.66 - 2026-08-16 05:55:06cloudlinux2 fail2ban: 2026-08-16 05:55:17,810 fail2ban.filter [1791]: INFO [plesk-wordpress] Found 58.252.236.66 - 2026-08-16 05:55:17cloudlinux2 fail2ban: 2026-08-16 05:55:18,227 fail2ban.filter [1791]: INFO [recidive] Found 58.252.236.66 - 2026-08-16 05:55:18cloudlinux2 fail2ban: 2026-08-16 05:55:18,221 fail2ban.actions [1791]: NOTICE [plesk-wordpress] Ban 58.252.236.66cloudlinux2 fail2ban: 2026-08-16 0 show less	Web App Attack
🇨🇿 ptlab	2026-08-15 12:45:24 (1 month ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇨🇭 backslash	2026-08-14 07:03:00 (1 month ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇫🇷 votrewebfacile	2026-08-12 23:42:21 (1 month ago)	brute force on admin	Web App Attack
🇮🇩 bps-statistics	2026-08-04 22:17:25 (1 month ago)	WP Login Scan Activities: "2026-08-05T05:17:25.795+07:00" "/wp-login.php" "211.253.197.83" "Mozilla/ ... show more WP Login Scan Activities: "2026-08-05T05:17:25.795+07:00" "/wp-login.php" "211.253.197.83" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 16:36:29 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 211.253.197.83 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 211.253.197.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 12:36:24.532373 2026] [security2:error] [pid 3128923:tid 3128923] [client 211.253.197.83:48898] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|primacomm.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "amY3iLfyirI8ef-jtRryOAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇴 190.181.44.194

🇮🇳 122.176.122.24

🇨🇳 106.12.124.63

🇹🇼 60.199.224.2

🇺🇸 45.61.92.146

🇭🇰 2602:80d:1004::2a

🇬🇧 185.216.145.178

🇺🇸 165.140.240.211

🇧🇩 103.138.250.243

🇺🇸 100.28.153.226

🇧🇬 79.124.56.182

🇺🇸 64.62.197.27

🇺🇸 216.25.89.75

🇺🇸 162.216.150.250

🇳🇱 160.119.66.12

🇻🇳 113.163.202.114

🇨🇳 106.12.179.53

🇨🇩 102.223.209.43

🇺🇸 99.36.114.89

🇪🇪 94.183.170.147