JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

159.223.12.201

Recent Activity

Abuse confidence score ?

100% Critical

2,997 reports

285 reporters · latest 2 days ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 159.223.12.201

Export CSV

This IP address has been reported a total of 2,997 times from 285 distinct sources. 159.223.12.201 was first reported on April 2nd 2025, and the most recent report was 2 days ago. In the last 60 days, the top reporter locations were: United States of America with 28 reports; Germany with 24 reports; France with 14 reports. The most common categories in these recent reports were: Web App Attack 100 times; Bad Web Bot 43 times; Brute-Force 39 times; Hacking 28 times; Port Scan 10 times; Other 19 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 TheCoon	2026-10-24 16:16:12 (2 days ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇨🇭 TheCoon	2026-10-23 06:21:39 (3 days ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇨🇭 TheCoon	2026-10-21 06:43:39 (5 days ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇮🇱 avatiah	2026-10-15 06:33:06 (1 week ago)	Automated block by fail2ban jail 'mystorytel-badpaths' on mystorytel.com	Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-10-14 22:17:16 (1 week ago)		Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-10-14 05:14:46 (1 week ago)	5 attacks on VC URLs, site downloads (type 2), Laravel URLs, env grabbing URLs, PHP URLs: GET /.git/ ... show more 5 attacks on VC URLs, site downloads (type 2), Laravel URLs, env grabbing URLs, PHP URLs: GET /.git/config HTTP/1.1 GET /demo HTTP/1.1 GET /_ignition/execute-solution HTTP/1.1 GET /.env HTTP/1.1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 show less	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-10-13 22:16:18 (1 week ago)		Brute-Force Web App Attack
Anonymous	2026-10-13 11:52:14 (1 week ago)	CrowdSec blocked IP for crowdsecurity/CVE-2017-9841 on localhost	Hacking Web App Attack
🇦🇹 Pingger Shikkoken	2026-10-13 11:39:07 (1 week ago)	2026-10-13T11:39:07+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC ... show more 2026-10-13T11:39:07+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=159.223.12.201 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=22881 DF PROTO=TCP SPT=2874 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-10-13T11:39:08+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=159.223.12.201 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=22882 DF PROTO=TCP SPT=2874 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-10-13T11:39:09+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=159.223.12.201 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=22883 DF PROTO=TCP SPT=2874 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Hacking Bad Web Bot
🇺🇸 antlac1	2026-10-13 11:30:42 (1 week ago)	crowdsecurity/http-path-traversal-probing	Brute-Force Web App Attack
Anonymous	2026-10-13 11:18:43 (1 week ago)	Detected by CrowdSec IP: 159.223.12.201 Scenario: crowdsecurity/CVE-2017-9841 Date: Tue, 13 Oct 2026 ... show more Detected by CrowdSec IP: 159.223.12.201 Scenario: crowdsecurity/CVE-2017-9841 Date: Tue, 13 Oct 2026 13:18:43 CEST (GMT +02:00) show less	Web App Attack Exploited Host Hacking
🇭🇷 bubausluge	2026-10-13 11:17:49 (1 week ago)	Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 68 attempts, Period: 2026-10-13 10:58 ... show more Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 68 attempts, Period: 2026-10-13 10:58:33 to 2026-10-13 10:58:33 show less	Web App Attack Bad Web Bot
Anonymous	2026-10-13 10:56:08 (1 week ago)	159.223.12.201 - - [13/Oct/2026:12:56:07 +0200] "GET /.env HTTP/1.1" 403 482 "-" "Mozilla/5.0 (Windo ... show more 159.223.12.201 - - [13/Oct/2026:12:56:07 +0200] "GET /.env HTTP/1.1" 403 482 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
Anonymous	2026-10-13 10:26:20 (1 week ago)	159.223.12.201 - - [13/Oct/2026:10:26:20 +0000] "GET /.env HTTP/1.1" 404 6872 "-" "Mozilla/5.0 (Wind ... show more 159.223.12.201 - - [13/Oct/2026:10:26:20 +0000] "GET /.env HTTP/1.1" 404 6872 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
Anonymous	2026-10-13 10:24:38 (1 week ago)	GET /.env HTTP/1.1 ...	Web App Attack

Showing 1 to 15 of 2997 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇺 220.240.154.30

🇨🇳 220.196.55.90

🇨🇳 220.182.14.60

🇨🇳 220.180.249.165

🇨🇳 220.180.166.214

🇺🇸 184.197.118.44

🇺🇸 172.203.251.103

🇯🇵 139.162.119.61

🇹🇼 128.14.236.41

🇰🇷 119.205.172.162

🇫🇮 80.66.83.80

🇨🇳 58.34.176.218

🇫🇷 51.91.96.79

🇺🇸 34.22.61.115

🇨🇳 222.89.138.40

🇨🇳 220.180.107.193

🇨🇳 220.179.87.203

🇨🇳 220.178.246.43

🇨🇳 220.165.85.39

🇨🇳 220.163.252.244