Elevated Risk
IP address 185.83.153.183 is a moderate-to-high risk address linked to VoIP fraud activity, with a threat level of 7 out of 10 and a confidence score of 91 percent based on 167 total abuse reports. The IP has been detected conducting fraudulent VoIP operations from the PebbleHost Ltd network in the United Kingdom during April and May 2026, with automated honeypot sensors flagging the activity at an intensity rated 8 out of 10. The volume and reliability of detections indicate this address is actively involved in telephony fraud rather than incidental scanning.
The data shows consistent abuse spanning approximately two months, with 20 recent reports specifically categorizing the activity as Fraud VoIP. Detection sources include 20 distinct automated honeypot sensors, confirming the IP is systematically probing or exploiting voice-over-internet protocol infrastructure. The high activity frequency and total report volume substantially exceed typical background noise from routine internet scanning, placing this address in the top tier of confirmed threat sources for this category.
VoIP fraud exploits internet telephony systems to make unauthorized calls, typically to premium-rate or international numbers for financial gain. Attackers may compromise poorly secured PBX systems, SIP proxies or phone handsets to route calls through victim infrastructure, leaving the owner to absorb charges. The real-world risk includes unexpected telecommunications bills, service degradation from resource consumption, and potential involvement in broader criminal call campaigns. For organizations running any VoIP service, exposure to such traffic represents a direct financial and reputational liability.
Site operators should block 185.83.153.183 at the firewall level and monitor for any related subnet activity. Implement call authentication standards such as STIR/SHAKEN to verify caller identity before allowing call routing. Restrict international and premium-rate dialing on exposed VoIP endpoints, and review call detail records regularly for anomalies. Use defensive tooling such as fail2ban to detect and auto-block repeated authentication attempts against SIP services. Ongoing monitoring of abuse feeds will help identify if the threat actor transitions to adjacent addresses within the PebbleHost network.
HK 
UA