159.65.148.196
Activity Trending Down
This IP hasn't received reports recently, which causes the score to decay.
- ISP
- DigitalOcean, LLC
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS14061
- Domain Name
- digitalocean.com
- Country
- 🇮🇳 India
- City
- Bengaluru, Karnataka
Abuse Reports
Total reports
414 from
175 distinct
reporters
First reported
Most recent report
Old reports
The most recent abuse report for this IP address is from
.
It is possible that this IP is no longer involved in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇨🇭 copestack |
Honeypot hit on ov-4e5936 (fail2ban jail: nginx-compat)
|
Web App Attack | |
| Anonymous |
Automated web scanner. Requested suspicious paths: /.git/index. UTC: 2026-10-20 04:09:23.
|
Web App Attack | |
| Anonymous |
Honeypot: hit a non-existent, robots.txt-disallowed trap path / fake admin console, then probed fake "database export" endpoints. Automated scanner attempting data theft / exfiltration.
|
Hacking Bad Web Bot Web App Attack | |
| 🇩🇪 sfmet-admin |
159.65.148.196 - - [20/Oct/2026:04:24:53 +0000] "GET /.git/index HTTP/2.0" 200 36 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
|
Web App Attack | |
| 🇳🇱 Alt255 |
|
Bad Web Bot Web App Attack | |
| Anonymous |
Honeypot: hit a non-existent, robots.txt-disallowed trap path / fake admin console on a WordPress store, then probed fake "database export" endpoints. Automated scanner attempting data theft / exfiltration.
|
Hacking Bad Web Bot Web App Attack | |
| 🇺🇸 consti.art |
Web vulnerability scanning (1 probes)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Activity at 2026-10-20 04:05 UTC
|
Web App Attack | |
| 🇫🇷 Kejult |
Honeypot Finding: repeated TCP service probing on TCP/443 (HTTPS); 2 application-level events across 2 source port(s). Sensor(s): H0neytr4p.
|
Port Scan | |
| 🇬🇧 sandra361 |
Port scan detected: 7 attempts across 1 port (8049). | Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=159.65.148.196 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=41704 DF PROTO=TCP SPT=52170 DPT=8049 WINDOW=64240 RES=0x00 ACK FIN URGP=0
|
Port Scan | |
| 🇺🇸 MPL |
tcp/8848
|
Port Scan | |
| 🇩🇪 DasDuo |
Attempt on port 9999. Blocked by firewall (unsolicited inbound, no prior outbound connection).
|
Port Scan | |
| 🇩🇪 iNetWorker |
trying to access non-authorized port
|
Port Scan | |
| 🇺🇸 MPL |
tcp/2404 (2 or more attempts)
|
Port Scan | |
| 🇺🇸 xmission.com |
Blocked by UFW (TCP on 8883)
Source port: 61012
TTL: 239
Packet length: 44
TOS: 0x00
This report (for 159.65.148.196) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇺🇸 sandra361 |
Port scan detected: 6 attempts across 1 port (8000). | Evidence: REAPER_TARPIT: IN=enp1s0 SRC=159.65.148.196 LEN=646 TOS=0x00 PREC=0x00 TTL=51 ID=56238 DF PROTO=TCP SPT=36172 DPT=8000 WINDOW=64240 RES=0x00 ACK PSH URGP=0
|
Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown