JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

165.227.138.104

Recent Activity

Abuse confidence score ?

100% Critical

104 reports

77 reporters · latest 2 hours ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 165.227.138.104

This IP address has been reported a total of 104 times from 77 distinct sources. 165.227.138.104 was first reported on December 14th 2024, and the most recent report was 2 hours ago. In the last 60 days, the top reporter locations were: Germany with 23 reports; France with 22 reports; Netherlands with 13 reports. The most common categories in these recent reports were: Port Scan 46 times; Brute-Force 29 times; Hacking 27 times; Web App Attack 27 times; Bad Web Bot 15 times; Other 23 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇪 venix	2026-09-30 08:12:02 (2 hours ago)	Unauthorized connection attempt detected from IP address 165.227.138.104 to port 445 (compute01.malm ... show more Unauthorized connection attempt detected from IP address 165.227.138.104 to port 445 (compute01.malmo) show less	Brute-Force Exploited Host
🇨🇭 Mario Bretscher	2026-09-30 07:59:03 (2 hours ago)	2026-09-30T09:59:02.305857+02:00 hades postfix/submission/smtpd[1697840]: improper command pipelinin ... show more 2026-09-30T09:59:02.305857+02:00 hades postfix/submission/smtpd[1697840]: improper command pipelining after CONNECT from unknown[165.227.138.104]: \026\003\003\001H\001\000\001D\003\003D\247S\027O]\237\261A.\376\236\225\367\225\310\034iJ)\301(\005\r\207\216\336Y\331\314\031\025 \2113\033\375Y\304\262\tuW\350h_f\233\346\202\305\373x$\021@\0347\314\274C\312'S\276\000D\300\023\300'\300/\300\024\300(\3000\300`\300a\300v\300w\314\250 2026-09-30T09:59:02.412493+02:00 hades postfix/submission/smtpd[1697840]: improper command pipelining after CONNECT from unknown[165.227.138.104]: \026\003\002\001\232\001\000\001\226\003\002\035\234\336\a\332\257\344\f\275\314k\311j\244\212\264\030Z\300&\337\177M\025\240\370q@\205t\224\222 \033\242Q\217B_\371\344+\277I\276d\376x\277\032\272\206\260/w-\3505\203\340/\326H\036\354\000\212\000\026\0003\000g\300\236\300\242\000\236\0009\000k\300\237\300\243\000\237 2026-09-30T09:59:02.518268+02:00 hades postfix/submission/smtpd[1697840]: improper command pipelining ... show less	Email Spam
🇩🇪 Kejult	2026-09-30 07:57:27 (2 hours ago)	Honeypot Finding: repeated TCP service probing on TCP/9092 (service); 4 application-level events acr ... show more Honeypot Finding: repeated TCP service probing on TCP/9092 (service); 4 application-level events across 4 source port(s). Sensor(s): Honeytrap. show less	Port Scan
🇩🇪 kkeyser	2026-09-30 07:43:30 (3 hours ago)	GET /solr/admin/info/system HTTP/1.1	Web App Attack
🇫🇷 Kejult	2026-09-30 07:06:51 (3 hours ago)	Honeypot Finding: repeated TCP service probing on TCP/2525 (service); 3 application-level events acr ... show more Honeypot Finding: repeated TCP service probing on TCP/2525 (service); 3 application-level events across 3 source port(s). Sensor(s): Honeytrap. show less	Port Scan
🇫🇷 Kejult	2026-09-30 06:05:00 (4 hours ago)	Honeypot Finding: verified TCP multi-port scan/probing; 5 application-level events across 3 target p ... show more Honeypot Finding: verified TCP multi-port scan/probing; 5 application-level events across 3 target ports and 5 source port(s). Ports: 1911/service, 21/FTP, 20000/service. Sensors: Honeytrap, Dionaea. show less	Port Scan
🇫🇷 Kejult	2026-09-30 05:47:22 (5 hours ago)	Honeypot Finding: repeated TCP service probing on TCP/1234 (service); 6 application-level events acr ... show more Honeypot Finding: repeated TCP service probing on TCP/1234 (service); 6 application-level events across 6 source port(s). Sensor(s): Honeytrap. show less	Port Scan
🇸🇪 cider1725	2026-09-30 04:26:28 (6 hours ago)	165.227.138.104 - - [30/Sep/2026:04:26:27 +0000] "GET /solr/admin/info/system HTTP/1.1" 444 0 "-" "G ... show more 165.227.138.104 - - [30/Sep/2026:04:26:27 +0000] "GET /solr/admin/info/system HTTP/1.1" 444 0 "-" "Go-http-client/1.1" "-" 165.227.138.104 - - [30/Sep/2026:04:26:27 +0000] "GET /solr/admin/info/system HTTP/1.1" 444 0 "-" "Go-http-client/1.1" "-" 165.227.138.104 - - [30/Sep/2026:04:26:27 +0000] "GET /solr/admin/info/system HTTP/1.1" 444 0 "-" "Go-http-client/1.1" "-" ... show less	Brute-Force Web App Attack
Anonymous	2026-09-30 03:42:43 (7 hours ago)	Hit honeypot r.	Port Scan Hacking Exploited Host
🇳🇱 Alt255	2026-09-30 03:10:03 (7 hours ago)	[mx02al] Mail server brute-force: 5 failed attempts detected by fail2ban jail exim-iptables.	Brute-Force
🇺🇸 chronos	2026-09-30 02:38:33 (8 hours ago)	[AUTORAVALT][[29/09/2026 - 23:38:32 -03:00 UTC] Attack from [DigitalOcean, LLC] [165.227.138.104] Ac ... show more [AUTORAVALT][[29/09/2026 - 23:38:32 -03:00 UTC] Attack from [DigitalOcean, LLC] [165.227.138.104] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Brute-Force -> Credential brute-force] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇳🇱 EGP Abuse Dept	2026-09-30 02:27:37 (8 hours ago)	Unauthorized connection to FTP port 21	Port Scan Hacking
🇫🇷 EvoX	2026-09-30 02:20:11 (8 hours ago)	🛡️ Honeypot [bsts-tpot-sensor]: Unauthorized traffic (297 bytes of payload); 4891 [1] TCP	Port Scan
🇦🇺 LiftUp Hosting	2026-09-30 01:33:48 (9 hours ago)	Honeypot hit: HTTP/1.1 request on 18789 GET /solr/admin/info/system User-Agent: Go-http-client/1.1; ... show more Honeypot hit: HTTP/1.1 request on 18789 GET /solr/admin/info/system User-Agent: Go-http-client/1.1; 18789 [6] TCP show less	Hacking Bad Web Bot
🇮🇱 avatiah	2026-09-30 01:08:48 (9 hours ago)	Automated block by fail2ban jail 'mystorytel-badpaths' on mystorytel.com	Bad Web Bot Web App Attack

Showing 1 to 15 of 104 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.174.30.215

🇨🇦 138.197.162.228

🇻🇳 103.109.39.15

🇰🇿 91.147.111.106

🇰🇿 91.147.90.36

🇧🇷 45.234.3.247

🇧🇪 35.195.54.152

🇷🇴 2.57.122.53

🇫🇷 217.182.253.249

🇰🇷 210.207.50.162

🇺🇦 188.190.244.37

🇭🇰 152.32.133.206

🇺🇸 102.129.153.69

🇺🇸 99.179.151.95

🇳🇱 77.239.124.44

🇮🇹 2600:3c0b::2000:ffff:fe58:da5f

🇨🇳 218.9.233.155

🇳🇱 185.223.235.36

🇯🇵 139.101.93.147

🇺🇸 129.121.102.102