JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.223.1.1

159.223.1.1 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 56%: ?

56%

ISP	DigitalOcean, LLC
Usage Type	Content Delivery Network
ASN	AS14061
Domain Name	digitalocean.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.223.1.1

Whois 159.223.1.1

IP Abuse Reports for 159.223.1.1:

This IP address has been reported a total of 15 times from 12 distinct sources. 159.223.1.1 was first reported on November 29th 2022, and the most recent report was 27 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 plzenskypruvodce.cz	2026-10-17 04:02:04 (27 minutes ago)	2026-10-17T05:53:30.584963+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for u ... show more 2026-10-17T05:53:30.584963+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:57:45.974204+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T06:02:04.079131+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for unknown user admin from 159.223.1.1 ... show less	Brute-Force
🇨🇭 Origon	2026-10-17 03:55:46 (33 minutes ago)	http-cve-probing - IP: 159.223.1.1 - time="2026-10-17T05:55:46+02:00" level=info msg="(555f66b4f6a7 ... show more http-cve-probing - IP: 159.223.1.1 - time="2026-10-17T05:55:46+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-cve-probing by ip 159.223.1.1 (NL/14061) : 4h ban on Ip 159.223.1.1" module=db show less	Web App Attack
🇨🇿 plzenskypruvodce.cz	2026-10-17 03:40:36 (48 minutes ago)	2026-10-17T05:32:17.063018+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for u ... show more 2026-10-17T05:32:17.063018+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:36:26.174756+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:40:35.817738+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for unknown user admin from 159.223.1.1 ... show less	Brute-Force
Anonymous	2026-10-17 03:22:12 (1 hour ago)	(wordpress) Failed wordpress login from 159.223.1.1 (-)	Brute-Force
🇨🇿 plzenskypruvodce.cz	2026-10-17 03:21:50 (1 hour ago)	2026-10-17T05:15:04.867666+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for u ... show more 2026-10-17T05:15:04.867666+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:18:34.813691+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:21:50.770427+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for unknown user admin from 159.223.1.1 ... show less	Brute-Force
🇮🇹 VHosting	2026-10-17 03:05:03 (1 hour ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇨🇿 plzenskypruvodce.cz	2026-10-17 03:04:34 (1 hour ago)	2026-10-17T05:02:44.772276+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for u ... show more 2026-10-17T05:02:44.772276+02:00 web wordpress(choteborky.cz)[1046989]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:03:42.049167+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for unknown user admin from 159.223.1.1 2026-10-17T05:04:34.236118+02:00 web wordpress(choteborky.cz)[1051865]: Authentication attempt for unknown user admin from 159.223.1.1 ... show less	Brute-Force
🇫🇮 as211431.net	2026-10-17 02:57:44 (1 hour ago)	Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /wp-login.php UA: Mozilla/5.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 FeG Deutschland	2026-10-17 02:45:13 (1 hour ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇺🇸 FreeMyIP	2026-10-17 02:43:47 (1 hour ago)	Automated fail2ban report: web application attack / scanning for exploitable paths.	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-17 02:40:01 (1 hour ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: gitlab.definitelynotahoneypot.xyz \| URI: /wp-login.php \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 MPL	2026-04-12 19:20:05 (6 months ago)	tcp/13000 (2 or more attempts)	Port Scan
🇦🇺 Starburst SysOp Team	2026-04-12 18:27:52 (6 months ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-syd2-4)	Hacking Bad Web Bot
🇫🇮 6kilowatti	2026-04-12 18:09:59 (6 months ago)	2026-04-12T21:09:58.792636+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00: ... show more 2026-04-12T21:09:58.792636+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=159.223.1.1 DST=83.148.240.21 LEN=44 TOS=0x00 PREC=0x00 TTL=245 ID=42238 PROTO=TCP SPT=61013 DPT=1245 WINDOW=1025 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇪🇸 IPV4Guard.com (AS215051)	2022-11-29 18:57:00 (3 years ago)	firewall,info SSH_ToMK input: in:ether1 out:(unknown 0), connection-state:new src-mac 00:5d:73:b9:5b ... show more firewall,info SSH_ToMK input: in:ether1 out:(unknown 0), connection-state:new src-mac 00:5d:73:b9:5b:4d, proto TCP (SYN), 159.223.1.1:41880->149.56.206.104:22, len 44 show less	Brute-Force SSH

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.114

🇩🇪 138.68.74.149

🇪🇬 196.219.224.230

🇳🇱 195.178.110.217

🇷🇺 176.96.248.38

🇳🇱 109.160.32.176

🇳🇱 109.160.32.126

🇳🇱 109.160.32.36

🇳🇱 45.74.59.2

🇵🇰 36.255.40.154

🇬🇧 35.203.210.177

🇨🇳 27.24.90.76

🇳🇵 202.51.89.78

🇺🇦 192.162.134.62

🇧🇪 104.199.36.53

🇳🇱 104.22.109.79

🇵🇰 103.115.198.158

🇺🇸 66.132.186.235

🇺🇸 45.33.105.182

🇹🇼 198.235.24.122