JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 165.245.220.107

165.245.220.107 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 99%: ?

99%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 165.245.220.107

Whois 165.245.220.107

IP Abuse Reports for 165.245.220.107:

This IP address has been reported a total of 21 times from 20 distinct sources. 165.245.220.107 was first reported on September 15th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 seniorlinuxadmin	2026-09-19 23:26:40 (5 hours ago)	Sep 20 00:26:31 - postfix/smtpd[22253]: lost connection after CONNECT from unknown[165.245.220.107] ... show more Sep 20 00:26:31 - postfix/smtpd[22253]: lost connection after CONNECT from unknown[165.245.220.107] Sep 20 00:26:31 - postfix/smtpd[22253]: improper command pipelining after CONNECT from unknown[165.245.220.107]: EHLO\r\n Sep 20 00:26:39 - postfix/smtpd[22253]: lost connection after EHLO from unknown[165.245.220.107] show less	Phishing Email Spam Brute-Force
Anonymous	2026-09-19 19:37:23 (9 hours ago)	587/tcp (1 or more attempts)	Port Scan
🇪🇸 raiolanetworks.com	2026-09-19 10:34:05 (18 hours ago)	Honeypot detection: port scan / service probe. 3 events observed. Reported automatically from a hone ... show more Honeypot detection: port scan / service probe. 3 events observed. Reported automatically from a honeypot sensor. show less	Port Scan
🇺🇸 IndigoRidge	2026-09-19 06:12:19 (23 hours ago)	Knock-Knock SMB honeypot activity; time=2026-09-19 06:07:28; smb_action=PROBE; smb_version=SMB1	Hacking Brute-Force
🇧🇾 hbars.by	2026-09-18 19:53:39 (1 day ago)	2026-09-18T22:53:32.127206+03:00 radionet dovecot: imap-login: Disconnected: Connection closed: read ... show more 2026-09-18T22:53:32.127206+03:00 radionet dovecot: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.245.220.107, lip=192.168.3.3, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<3BZIQcdb/7ml9dxr> 2026-09-18T22:53:38.488698+03:00 radionet dovecot: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:0A00018C:SSL routines::version too low (no auth attempts in 6 secs): user=<>, rip=165.245.220.107, lip=192.168.3.3, TLS handshaking: SSL_accept() failed: error:0A00018C:SSL routines::version too low, session=<5CepQcdbhWSl9dxr> show less	Brute-Force
🇺🇸 donarev419	2026-09-18 15:26:53 (1 day ago)	Port scan detected on port 18789 (connection without data transfer)	Port Scan
Anonymous	2026-09-18 14:37:55 (1 day ago)	80/tcp (1 or more attempts)	Port Scan
🇨🇱 ovallevelasquezanibal	2026-09-18 12:00:24 (1 day ago)	Detectado por Wazuh SIEM en api-ux.com \| Alertas: 5 \| Nivel max: 5 \| Agentes: web-apiux-2025 \| Web s ... show more Detectado por Wazuh SIEM en api-ux.com \| Alertas: 5 \| Nivel max: 5 \| Agentes: web-apiux-2025 \| Web server 400 error code. show less	Port Scan Hacking
🇳🇴 kyatto	2026-09-18 08:48:26 (1 day ago)	Sep 18 10:48:17 mail postfix/smtpd[52251]: improper command pipelining after CONNECT from unknown[16 ... show more Sep 18 10:48:17 mail postfix/smtpd[52251]: improper command pipelining after CONNECT from unknown[165.245.220.107]: HELP\r\n Sep 18 10:48:24 mail postfix/smtpd[52251]: lost connection after UNKNOWN from unknown[165.245.220.107] ... show less	SSH
🇦🇪 abusiveIntelligence	2026-09-18 05:10:00 (2 days ago)	RDP connect attempt: Nmap Scanner	Brute-Force
🇺🇸 gu-alvareza	2026-09-18 05:06:29 (2 days ago)	Nmap.Script.Scanner	Port Scan
🇺🇸 kosada.com	2026-09-17 22:06:30 (2 days ago)	Repeated requests for suspicious nonexistent URLs, for example: /evox/about (HTTP/1.1 port 443, bogu ... show more Repeated requests for suspicious nonexistent URLs, for example: /evox/about (HTTP/1.1 port 443, bogus vhost, user agent: "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)") show less	Web App Attack
🇹🇼 tyebstx	2026-09-17 19:09:01 (2 days ago)	Wazuh Alert Evidence: 165.245.220.107 - - [17/Sep/2026:19:08:58 +0000] "OPTIONS / HTTP/1.0" 444 0 "- ... show more Wazuh Alert Evidence: 165.245.220.107 - - [17/Sep/2026:19:08:58 +0000] "OPTIONS / HTTP/1.0" 444 0 "-" "-" "-" show less	Web App Attack
🇭🇰 CyberFox	2026-09-17 19:08:08 (2 days ago)	23/tcp (1 or more attempts)	Port Scan
🇺🇸 TAY	2026-09-17 13:39:24 (2 days ago)	2026-09-17 21:39:16 pop3-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=165.24 ... show more 2026-09-17 21:39:16 pop3-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=165.245.220.107, lip=162.220.160.187, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<DvL36K1bp0al9dxr> 2026-09-17 21:39:22 pop3-login: Info: Disconnected (no auth attempts in 6 secs): user=<>, rip=165.245.220.107, lip=162.220.160.187, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<eQNb6a1bvS6l9dxr> 2026-09-17 21:39:23 pop3-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=165.245.220.107, lip=162.220.160.187, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<self6a1ba3ql9dxr> 2026-09-17 21:39:23 pop3-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=165.245.220.107, lip=162.220.160.187, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_cl ... show less	Brute-Force

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 205.185.118.81

🇧🇷 179.109.172.178

🇺🇸 173.48.107.47

🇭🇰 165.154.43.92

🇺🇸 152.32.208.169

🇺🇸 143.110.233.172

🇺🇸 109.105.210.69

🇺🇸 107.150.105.153

🇨🇳 106.75.177.125

🇻🇳 103.75.76.81

🇺🇸 76.102.6.217

🇫🇷 62.210.158.41

🇭🇰 45.249.245.55

🇯🇵 43.167.254.172

🇩🇪 31.70.96.84

🇨🇳 220.168.85.66

🇫🇷 213.32.19.170

🇹🇼 198.235.24.116

🇱🇹 185.2.228.48

🇨🇱 179.57.170.71