JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 165.22.18.233

165.22.18.233 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 73%: ?

73%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 165.22.18.233

Whois 165.22.18.233

IP Abuse Reports for 165.22.18.233:

This IP address has been reported a total of 22 times from 20 distinct sources. 165.22.18.233 was first reported on January 13th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-10-21 14:40:54 (1 day ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-21 UTC.	Brute-Force
🇮🇪 AutosOnShow	2026-10-20 17:27:27 (2 days ago)	blocked for webapp attack \| path requested: /.git/config \| seen at 2026-10-20 17:26:24.625 \|	Web App Attack
🇳🇱 Alt255	2026-10-20 17:19:30 (2 days ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 165 ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 165.22.18.233 - - \[20/Oct/2026:19:19:14 +0200\] "GET /.git/config HTTP/1.1" 404 3473 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/81.0.4044.129 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 Lea	2026-10-20 17:03:48 (2 days ago)	Malicious web probe on bearstool.com: 165.22.18.233 - - [20/Oct/2026:13:03:48 -0400] "GET /.git/conf ... show more Malicious web probe on bearstool.com: 165.22.18.233 - - [20/Oct/2026:13:03:48 -0400] "GET /.git/config HTTP/1.1" 444 0 "" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-10-20 16:50:25 (2 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-10-20 16:50:13 (2 days ago)	[redacted] 165.22.18.233 - - [20/Oct/2026:17:50:10 +0100] "GET /.git/config HTTP/1.1" 307 423 "-" "M ... show more [redacted] 165.22.18.233 - - [20/Oct/2026:17:50:10 +0100] "GET /.git/config HTTP/1.1" 307 423 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" [redacted] 165.22.18.233 - - [20/Oct/2026:17:50:12 +0100] "GET /.git/config HTTP/1.1" 307 5736 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Bad Web Bot Web App Attack
🇮🇪 AutosOnShow	2026-10-20 16:26:30 (2 days ago)	blocked for webapp attack \| path requested: /.git/config \| seen at 2026-10-20 16:26:12.239 \|	Web App Attack
🇺🇸 CollideTech	2026-10-20 16:02:59 (2 days ago)	found poking around where they should not be	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-20 15:58:23 (2 days ago)	[ti-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 165.22.18.233 - - [20/Oct/2026:17:58:13 +0200] "GET /.git/config HTTP/1.1" 404 7912 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇧🇪 voormedia	2026-10-20 15:50:32 (2 days ago)	Accessed trap at '/.git/config'	Web App Attack
Anonymous	2026-10-20 15:49:59 (2 days ago)	1792511399.0 fail2ban apache-modsecurity [Tue Oct 20 17:49:59.151183 2026] [:error] [pid 341199:tid ... show more 1792511399.0 fail2ban apache-modsecurity [Tue Oct 20 17:49:59.151183 2026] [:error] [pid 341199:tid 341224] [client 165.22.18.233:44134] [client 165.22.18.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "langua ... show less	Web App Attack
🇫🇷 Kejult	2026-10-20 15:46:22 (2 days ago)	Honeypot Finding: verified TCP multi-port scan/probing; 6 application-level events across 2 target p ... show more Honeypot Finding: verified TCP multi-port scan/probing; 6 application-level events across 2 target ports and 3 source port(s). Ports: 80/HTTP, 443/HTTPS. Sensors: H0neytr4p, Tanner. show less	Port Scan
🇺🇸 azminawwar	2026-10-20 15:34:29 (2 days ago)	[165.22.18.233] triggered by honeypot on port [80], Timestamp [2026-10-20T15:34:28Z]METHOD=GET PATH= ... show more [165.22.18.233] triggered by honeypot on port [80], Timestamp [2026-10-20T15:34:28Z]METHOD=GET PATH=/.git/config HTTP=HTTP/1.1 UA="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko show less	Port Scan Hacking
🇳🇱 wlt-blocker	2026-10-20 15:29:15 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 MPL	2026-01-14 02:01:25 (9 months ago)	tcp/8443	Port Scan

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.238

🇺🇦 193.107.114.117

🇻🇪 190.153.67.118

🇬🇧 188.240.59.51

🇵🇪 179.6.73.39

🇺🇸 165.217.38.17

🇳🇱 138.226.239.233

🇺🇸 129.222.242.72

🇺🇸 94.139.56.49

🇳🇱 77.91.71.91

🇩🇪 68.183.79.225

🇧🇷 45.179.112.74

🇫🇷 45.157.112.239

🇺🇸 34.227.234.246

🇷🇴 2.57.121.112

🇺🇸 222.167.118.118

🇺🇸 188.241.0.55

🇳🇱 185.136.15.80

🇺🇸 162.216.149.83

🇨🇳 120.236.49.131