JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 165.22.199.3

165.22.199.3 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 65%: ?

65%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 165.22.199.3

Whois 165.22.199.3

IP Abuse Reports for 165.22.199.3:

This IP address has been reported a total of 19 times from 14 distinct sources. 165.22.199.3 was first reported on February 8th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-09-17 18:30:29 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: pma.teddypot.pro \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-17 12:07:23 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.sweetpuddingtrap.xyz \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 Ar1s	2026-09-17 11:45:22 (3 days ago)	[1:2610312] TGI HUNT HTTP POST to wp-.* Path Without Referer ::: Port: 80/TCP	Exploited Host
🇺🇸 Jason Howell	2026-09-17 11:11:07 (3 days ago)	165.22.199.3 - - [17/Sep/2026:04:40:52 -0500] "POST /wp-login.php HTTP/1.1" 503 22235 "-" "Mozilla/5 ... show more 165.22.199.3 - - [17/Sep/2026:04:40:52 -0500] "POST /wp-login.php HTTP/1.1" 503 22235 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:04:46:03 -0500] "POST /wp-login.php HTTP/1.1" 503 23428 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:04:51:19 -0500] "POST /wp-login.php HTTP/1.1" 503 22234 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:06:05:37 -0500] "POST /wp-login.php HTTP/1.1" 503 23430 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:06:11:06 -0500] "POST /wp-login.php HTTP/1.1" 503 22238 "-" "Mozilla/5.0" ... show less	Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-09-17 10:08:01 (3 days ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack
🇩🇪 DocNetzwerk	2026-09-17 08:50:12 (3 days ago)	(PERMBLOCK) 165.22.199.3 (-) has had more than 3 temp blocks	Hacking
🇺🇸 Jason Howell	2026-09-17 08:32:44 (3 days ago)	165.22.199.3 - - [17/Sep/2026:02:01:00 -0500] "POST /wp-login.php HTTP/1.1" 503 22234 "-" "Mozilla/5 ... show more 165.22.199.3 - - [17/Sep/2026:02:01:00 -0500] "POST /wp-login.php HTTP/1.1" 503 22234 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:02:06:06 -0500] "POST /wp-login.php HTTP/1.1" 503 23427 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:02:10:58 -0500] "POST /wp-login.php HTTP/1.1" 503 22236 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:03:27:29 -0500] "POST /wp-login.php HTTP/1.1" 503 23426 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:03:32:43 -0500] "POST /wp-login.php HTTP/1.1" 503 22235 "-" "Mozilla/5.0" ... show less	Web App Attack
Anonymous	2026-09-17 07:13:59 (3 days ago)	Scenarios: http-cve-probing Total requests: 11	Web App Attack
🇩🇪 FD-IX	2026-09-17 05:49:39 (3 days ago)	Fail2Ban: WordPress brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 Jason Howell	2026-09-17 05:46:17 (3 days ago)	165.22.199.3 - - [17/Sep/2026:00:18:54 -0500] "GET /wp-login.php HTTP/1.1" 301 613 "-" "Mozilla/5.0" ... show more 165.22.199.3 - - [17/Sep/2026:00:18:54 -0500] "GET /wp-login.php HTTP/1.1" 301 613 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:00:18:54 -0500] "GET /wp-login.php HTTP/1.1" 200 6684 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:00:41:56 -0500] "POST /wp-login.php HTTP/1.1" 503 23426 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:00:44:09 -0500] "POST /wp-login.php HTTP/1.1" 503 18643 "-" "Mozilla/5.0" 165.22.199.3 - - [17/Sep/2026:00:46:16 -0500] "POST /wp-login.php HTTP/1.1" 503 22235 "-" "Mozilla/5.0" ... show less	Web App Attack
🇳🇱 Alt255	2026-09-17 05:44:25 (3 days ago)	[ti-14al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail <name>. Examp ... show more [ti-14al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail <name>. Example: 165.22.199.3 - - \[17/Sep/2026:07:42:11 +0200\] "POST /wp-login.php HTTP/1.1" 200 19437 "-" "Mozilla/5.0" 165.22.199.3 - - \[17/Sep/2026:07:42:11 +0200\] "POST /wp-login.php HTTP/1.1" 200 19682 "-" "Mozilla/5.0" 165.22.199.3 - - \[17/Sep/2026:07:44:21 +0200\] "POST /wp-login.php HTTP/1.1" 200 19437 "-" "Mozilla/5.0" 165.22.199.3 - - \[17/Sep/2026:07:44:21 +0200\] "POST /wp-login.php HTTP/1.1" 200 19682 "-" "Mozilla/5.0" ... show less	Brute-Force Web App Attack
🇩🇪 DocNetzwerk	2026-09-17 05:42:42 (3 days ago)	(wordpress) Failed wordpress login from 165.22.199.3 (-)	Brute-Force
🇩🇪 EGP Abuse Dept	2026-09-17 05:13:29 (3 days ago)	Scanning for web/db/file exploits on www.pcdiscounter.nl	SQL Injection Bad Web Bot Web App Attack
Anonymous	2026-09-17 05:08:40 (3 days ago)	Fail2Ban nginx-scanner-sweep: web scanner activity	Bad Web Bot
🇵🇱 Budyn	2026-09-17 04:49:22 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.sweetpuddingtrap.xyz \| URI: /wp-login.php \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.30

🇳🇱 176.65.148.96

🇵🇱 176.53.159.198

🇻🇳 113.176.85.112

🇺🇸 52.165.91.155

🇩🇪 45.3.47.78

🇷🇺 195.206.63.137

🇺🇸 174.97.30.5

🇹🇼 128.14.226.236

🇰🇷 118.194.249.72

🇰🇷 118.37.214.187

🇨🇳 116.179.32.87

🇮🇳 103.97.215.11

🇺🇸 45.156.129.123

🇳🇱 45.148.10.157

🇺🇸 40.124.180.50

🇧🇷 16.5.0.236

🇧🇷 177.126.90.235

🇻🇳 103.153.65.59

🇺🇸 51.81.105.29