JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.203.9.72

159.203.9.72 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 56%: ?

56%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.203.9.72

Whois 159.203.9.72

IP Abuse Reports for 159.203.9.72:

This IP address has been reported a total of 21 times from 18 distinct sources. 159.203.9.72 was first reported on June 10th 2021, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 drewf.ink	2026-09-02 17:56:08 (17 hours ago)	[17:56] Attempted to relay through an open SOCKS5 proxy (CONNECT to icanhazip.com:80)	Open Proxy
🇺🇸 xmission.com	2026-09-02 13:50:16 (21 hours ago)	Blocked by UFW (TCP on 443) Source port: 64732 TTL: 50 Packet length: 64 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 443) Source port: 64732 TTL: 50 Packet length: 64 TOS: 0x08 This report (for 159.203.9.72) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇫🇷 Coco Bongo	2026-08-31 18:01:11 (2 days ago)	1788199271 - 08/31/2026 20:01:11 Host: 159.203.9.72/159.203.9.72 Port: 1080 TCP Blocked ...	Port Scan
🇳🇱 donarev419	2026-08-30 06:26:21 (4 days ago)	Connection to port 1180 with data transfer. Data preview:	Port Scan Hacking
🇺🇸 xmission.com	2026-08-30 01:12:13 (4 days ago)	Blocked by UFW (TCP on 3231) Source port: 62954 TTL: 50 Packet length: 64 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 3231) Source port: 62954 TTL: 50 Packet length: 64 TOS: 0x08 This report (for 159.203.9.72) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-08-30 00:55:01 (4 days ago)	Blocked by os-abuseipdb; 7 hits, proto=tcp, ports=1194,443,4443,5555,80,8443,9201	Port Scan Hacking Brute-Force
🇺🇸 donarev419	2026-08-30 00:52:21 (4 days ago)	Connection to port 443 with data transfer. Data preview: �	Port Scan Hacking
🇺🇸 Cyber Crusader	2026-08-28 09:12:42 (6 days ago)	Hundreds of Attempts (at least) to Connect to and Access Firewall Ports	Port Scan Hacking Brute-Force
🇳🇱 Tsumugi Kotobuki	2026-08-28 08:31:56 (6 days ago)	Port Scan on Honeypot \| Ports: 3389/RDP \| Proto: TCP(1) \| Flags: all SYN \| TTL: 48 \| Len: 64B \| Win: ... show more Port Scan on Honeypot \| Ports: 3389/RDP \| Proto: TCP(1) \| Flags: all SYN \| TTL: 48 \| Len: 64B \| Win: 65535(1) \| F2B/ufw-honeypot@2026-08-28T08:31:56Z show less	Port Scan Hacking
🇯🇵 Summer Joe	2026-08-25 06:17:05 (1 week ago)	Automated report: port-scan (cat14) / SSH brute-force (cat18,22) against VPS japan2, detected via UF ... show more Automated report: port-scan (cat14) / SSH brute-force (cat18,22) against VPS japan2, detected via UFW BLOCK + fail2ban + lastb. show less	Port Scan
Anonymous	2026-08-23 14:40:00 (1 week ago)	17052/tcp,33573/tcp,18342/tcp,54953/tcp,32831/tcp,64493/tcp,22991/tcp,5093/tcp,54873/tcp,33889/tcp,5 ... show more 17052/tcp,33573/tcp,18342/tcp,54953/tcp,32831/tcp,64493/tcp,22991/tcp,5093/tcp,54873/tcp,33889/tcp,56250/tcp,46823/tcp,24800/tcp,50217/tcp,7491/tcp,13681/tcp,9772/tcp,5484/tcp,47451/tcp,63539/tcp,46588/tcp,29939/tcp,22398/tcp,30643/tcp,1458/tcp,55100/tcp,49371/tcp,60527/tcp (133 or more attempts) show less	Port Scan
🇫🇮 Ticlem	2026-08-23 07:04:07 (1 week ago)	2026-08-23T09:04:03.678114+02:00 clement-turlure kernel: [8474869.916169] [UFW BLOCK] IN=enp0s31f6 O ... show more 2026-08-23T09:04:03.678114+02:00 clement-turlure kernel: [8474869.916169] [UFW BLOCK] IN=enp0s31f6 OUT= MAC=90:1b:0e:f7:16:fb:d0:07:ca:8d:22:75:08:00 SRC=159.203.9.72 DST=95.216.21.136 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=12311 DF PROTO=TCP SPT=60138 DPT=8080 WINDOW=64240 RES=0x00 SYN URGP=0 2026-08-23T09:04:04.707084+02:00 clement-turlure kernel: [8474870.945165] [UFW BLOCK] IN=enp0s31f6 OUT= MAC=90:1b:0e:f7:16:fb:d0:07:ca:8d:22:75:08:00 SRC=159.203.9.72 DST=95.216.21.136 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=12312 DF PROTO=TCP SPT=60138 DPT=8080 WINDOW=64240 RES=0x00 SYN URGP=0 2026-08-23T09:04:06.722137+02:00 clement-turlure kernel: [8474872.960228] [UFW BLOCK] IN=enp0s31f6 OUT= MAC=90:1b:0e:f7:16:fb:d0:07:ca:8d:22:75:08:00 SRC=159.203.9.72 DST=95.216.21.136 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=12313 DF PROTO=TCP SPT=60138 DPT=8080 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇳🇱 homeshowdomain.nl	2026-06-08 21:59:35 (2 months ago)	Auto-ban: 12 malicious requests on 2026-06-07 (e.g., env/backup probes, brute-force, or error bursts ... show more Auto-ban: 12 malicious requests on 2026-06-07 (e.g., env/backup probes, brute-force, or error bursts). show less	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-06-07 21:59:36 (2 months ago)	Auto-ban: >3000 req/min op 2026-06-07	Web App Attack SSH Hacking
🇺🇸 MPL	2026-06-07 13:20:15 (2 months ago)	tcp/4000 (2 or more attempts)	Port Scan

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 2a00:dd0:0:115:b9f9:eecb:2e1e:63a3

🇺🇸 2600:3c02::2000:74ff:fe8e:d11c

🇹🇭 183.88.232.183

🇺🇸 173.239.218.253

🇹🇳 165.51.226.68

🇵🇰 163.61.129.102

🇮🇳 122.170.100.253

🇰🇷 121.188.193.78

🇰🇷 121.165.36.99

🇨🇳 116.179.32.179

🇺🇸 64.253.94.10

🇺🇸 47.251.24.141

🇫🇷 194.182.117.233

🇺🇸 147.185.132.241

🇺🇸 129.121.75.215

🇰🇷 119.192.210.110

🇨🇳 113.120.74.16

🇰🇷 112.187.204.188

🇺🇸 67.55.189.211

🇲🇾 49.124.159.190