JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 165.22.166.123

165.22.166.123 was found in our database!

This IP was reported 43 times. Confidence of Abuse is 66%: ?

66%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Santa Clara, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 165.22.166.123

Whois 165.22.166.123

IP Abuse Reports for 165.22.166.123:

This IP address has been reported a total of 43 times from 26 distinct sources. 165.22.166.123 was first reported on April 16th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-06-08 10:32:43 (1 week ago)	Blocked by UFW (TCP on 6850) Source port: 49603 TTL: 54 Packet length: 44 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 6850) Source port: 49603 TTL: 54 Packet length: 44 TOS: 0x08 This report (for 165.22.166.123) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇯🇵 mkaraki	2026-06-08 08:32:08 (1 week ago)	1780907526 # Service_probe # SIGNATURE_SEND # source_ip:165.22.166.123 # dst_port:6001 ...	Port Scan
Anonymous	2026-05-31 04:20:58 (2 weeks ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇺🇸 itsnixk	2026-05-30 21:13:09 (2 weeks ago)	(mod_security) mod_security (id:920280) triggered by 165.22.166.123 (US/United States/-): 1 in the l ... show more (mod_security) mod_security (id:920280) triggered by 165.22.166.123 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat May 30 17:13:06.594170 2026] [security2:error] [pid 1128687:tid 1128830] [client 165.22.166.123:54652] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "567"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.25.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "ahtS4mZ350wEiHwRv1zJVgAAADw"] show less	Port Scan
🇺🇸 xmission.com	2026-05-30 18:40:46 (2 weeks ago)	Blocked by UFW (TCP on 1723) Source port: 49732 TTL: 54 Packet length: 44 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 1723) Source port: 49732 TTL: 54 Packet length: 44 TOS: 0x08 This report (for 165.22.166.123) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2026-05-30 14:03:24 (2 weeks ago)	tcp/444 (2 or more attempts)	Port Scan
🇳🇱 COMPLEX	2026-05-30 00:33:14 (2 weeks ago)	Unsolicited TCP traffic \| Action: DROP \| Port 6379	Brute-Force
Anonymous	2026-05-29 23:19:27 (2 weeks ago)	2026-05-29T23:18:12.492662+00:00 UnitedStates1 sshd-session[866788]: Connection closed by 165.22.166 ... show more 2026-05-29T23:18:12.492662+00:00 UnitedStates1 sshd-session[866788]: Connection closed by 165.22.166.123 port 35438 [preauth] 2026-05-29T23:19:26.312392+00:00 UnitedStates1 sshd-session[872148]: banner exchange: Connection from 165.22.166.123 port 33072: invalid format [preauth] ... show less	Brute-Force SSH
Anonymous	2026-05-29 19:24:24 (2 weeks ago)	May 29 15:23:48 localhost kernel: [108427952.827799] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:9 ... show more May 29 15:23:48 localhost kernel: [108427952.827799] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=165.22.166.123 DST=[mungedIP2] LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=50163 DF PROTO=TCP SPT=52922 DPT=13 WINDOW=65280 RES=0x00 SYN URGP=0 May 29 15:23:48 localhost kernel: [108427952.827825] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=165.22.166.123 DST=[mungedIP2] LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=50163 DF PROTO=TCP SPT=52922 DPT=13 SEQ=4016766741 ACK=0 WINDOW=65280 RES=0x00 SYN URGP=0 OPT (02040550) May 29 15:24:24 localhost kernel: [108427988.154499] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=165.22.166.123 DST=[mungedIP2] LEN=36 TOS=0x00 PREC=0x00 TTL=51 ID=0 PROTO=UDP SPT=52975 DPT=13 LEN=16 May 29 15:24:24 localhost kernel: [108427988.154524] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=165.22.166.123 DST=[mungedIP2] LEN=36 TOS=0x00 PREC=0x show less	Port Scan
🇺🇸 withfallback.com	2026-05-28 21:37:45 (2 weeks ago)	client sends "random1random2random3random4". A quick Google indicates this is likely part of an nmap ... show more client sends "random1random2random3random4". A quick Google indicates this is likely part of an nmap scan. show less	Port Scan
🇳🇱 COMPLEX	2026-05-28 04:25:12 (2 weeks ago)	Unsolicited TCP traffic \| Action: DROP \| Port 3307	Brute-Force
🇺🇸 LSPCCU	2026-05-27 20:48:16 (2 weeks ago)	TSEC Honeypot Network report. Threat score: 100/100. Categories: Port Scan, Hacking, Brute-Force, We ... show more TSEC Honeypot Network report. Threat score: 100/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: ssh-telnet, cowrie. Context: 165. show less	Port Scan Hacking Brute-Force Web App Attack SSH
🇺🇸 etu brutus	2026-05-25 03:23:26 (3 weeks ago)	165.22.166.123 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
🇺🇸 Cyber Crusader	2026-05-24 18:51:39 (3 weeks ago)	Hundreds of Attempts (at least) to Connect to and Access Firewall Ports	Port Scan Hacking Brute-Force
🇺🇸 xmission.com	2026-05-23 08:48:19 (3 weeks ago)	Blocked by UFW (TCP on 5009) Source port: 51563 TTL: 54 Packet length: 44 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 5009) Source port: 51563 TTL: 54 Packet length: 44 TOS: 0x08 This report (for 165.22.166.123) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇹 196.188.225.30

🇰🇿 188.124.246.45

🇫🇷 176.191.43.176

🇰🇪 154.77.253.82

🇺🇸 135.237.126.103

🇨🇳 111.42.60.41

🇨🇳 101.206.107.245

🇧🇬 94.236.214.240

🇳🇱 88.210.63.69

🇧🇬 78.128.112.30

🇱🇹 62.60.130.251

🇲🇾 49.124.150.253

🇫🇷 158.220.125.127

🇨🇦 146.190.242.161

🇨🇳 120.228.34.70

🇨🇳 111.46.77.2

🇲🇦 105.72.240.36

🇲🇾 49.124.150.252

🇧🇷 45.165.14.197

🇺🇸 45.132.227.230