JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 5.199.163.86

5.199.163.86 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 50%: ?

50%

ISP	UAB Cherry Servers
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16125
Hostname(s)	ip-5-199-163-86.009.ptr.cherryservers.net
Domain Name	cherryservers.com
Country	🇱🇹 Lithuania
City	Siauliai, Siauliai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 5.199.163.86

Whois 5.199.163.86

IP Abuse Reports for 5.199.163.86:

This IP address has been reported a total of 8 times from 8 distinct sources. 5.199.163.86 was first reported on October 23rd 2026, and the most recent report was 19 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 Tom Tamagawa	2026-10-23 12:48:00 (19 minutes ago)	Attempted discovery of exposed server logs	Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-10-23 11:43:00 (1 hour ago)	IPBlock protected site ID [1438-do]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
Anonymous	2026-10-23 11:39:23 (1 hour ago)	IP matched detection query bad paths many.	Brute-Force Web App Attack
🇬🇧 Apache	2026-10-23 11:39:21 (1 hour ago)	(mod_security) mod_security (id:210730) triggered by 5.199.163.86 (LT/Lithuania/ip-5-199-163-86.009. ... show more (mod_security) mod_security (id:210730) triggered by 5.199.163.86 (LT/Lithuania/ip-5-199-163-86.009.ptr.cherryservers.net): 5 in the last 300 secs (CF_ENABLE) show less	Brute-Force SSH Web App Attack
🇪🇸 bohl-aiG5aef	2026-10-23 11:39:19 (1 hour ago)	Suricata Alert [SID:2009955] ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerab ... show more Suricata Alert [SID:2009955] ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability show less	Web App Attack
🇫🇮 sibahota	2026-10-23 11:35:03 (1 hour ago)	5.199.163.86 - - [23/Oct/2026:11:34:59 +0000] nidandiagnostic.com "GET /.ssh/id_rsa HTTP/1.1" 404 66 ... show more 5.199.163.86 - - [23/Oct/2026:11:34:59 +0000] nidandiagnostic.com "GET /.ssh/id_rsa HTTP/1.1" 404 6673 0.003 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.10 Safari/605.1.15" 172.17.0.1:3051 404 0.004 "http://nidandiagnostic.com/.ssh/id_rsa" ... show less	Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-10-23 11:31:49 (1 hour ago)	(mod_security) mod_security (id:210730) triggered by 5.199.163.86 (ip-5-199-163-86.009.ptr.cherryser ... show more (mod_security) mod_security (id:210730) triggered by 5.199.163.86 (ip-5-199-163-86.009.ptr.cherryservers.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 07:31:45.504369 2026] [security2:error] [pid 20112:tid 20112] [client 5.199.163.86:48864] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|modmove.com\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "modmove.com"] [uri "/configuration.php.bak"] [unique_id "attFoWM7u6FThVbBksVfqgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 david.houstin	2026-10-23 11:31:38 (1 hour ago)	5.199.163.86 - - [23/Oct/2026:13:31:15 +0200] "GET /wp-config.php.save HTTP/1.1" 404 3503 "-" "Mozil ... show more 5.199.163.86 - - [23/Oct/2026:13:31:15 +0200] "GET /wp-config.php.save HTTP/1.1" 404 3503 "-" "Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" 19991 - 5.199.163.86 - - [23/Oct/2026:13:31:18 +0200] "GET /wp-config.php.old HTTP/1.1" 404 3502 "-" "Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" 13735 - 5.199.163.86 - - [23/Oct/2026:13:31:24 +0200] "GET /wp-config.php.txt HTTP/1.1" 404 3502 "-" "Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:140.0) Gecko/20100101 Firefox/140.0" 11664 - 5.199.163.86 - - [23/Oct/2026:13:31:30 +0200] "GET /wp-config.php.orig HTTP/1.1" 404 3502 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1" 11441 - 5.199.163.86 - - [23/Oct/2026:13:31:33 +0200] "GET /wp-config.php.1 HTTP/1.1" 404 3502 "-" "Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1 ... show less	Web App Attack Bad Web Bot

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇦 200.46.67.117

🇻🇳 171.237.176.209

🇬🇧 77.67.26.108

🇺🇸 66.228.53.136

🇨🇳 223.100.32.215

🇳🇱 213.152.161.73

🇺🇸 178.171.22.149

🇮🇳 152.59.46.221

🇺🇸 144.172.108.80

🇩🇪 139.59.136.184

🇳🇱 138.226.239.233

🇧🇷 131.161.249.165

🇺🇸 129.121.117.162

🇩🇪 128.14.225.164

🇨🇿 109.81.85.195

🇮🇳 106.77.93.219

🇻🇳 103.110.87.57

🇳🇬 102.90.116.35

🇹🇷 95.0.32.188

🇳🇱 89.124.101.214