JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 165.245.252.131

165.245.252.131

Activity Trending Down

21 reports found in our database

50% ▼ ▼ ▼ Elevated

Abuse confidence score ?

ISP

DigitalOcean, LLC

Usage Type

Data Center/Web Hosting/Transit

ASN

AS14061

Domain Name

digitalocean.com

Country

🇩🇪 Germany

City

Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 165.245.252.131:

This IP address has been reported a total of 21 times from 19 distinct sources. 165.245.252.131 was first reported on August 10th 2026, and the most recent report was 4 weeks ago. In the last 60 days, the top reporter locations were: Germany with 5 reports; United States of America with 5 reports; Netherlands with 3 reports. The most common categories in these recent reports were: Port Scan 10 times; Brute-Force 10 times; Hacking 6 times; SSH 6 times; Web App Attack 3 times; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 adnscom.net	2026-08-14 05:14:33 (4 weeks ago)	IPS trigger: Brute force SSH scanning/attack	Brute-Force SSH
🇮🇳 Parth Maniar	2026-08-14 04:48:22 (4 weeks ago)	This IP address carried out 4 port scanning attempts on 13-08-2026. For more information or to repor ... show more This IP address carried out 4 port scanning attempts on 13-08-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Port Scan SSH
🇩🇪 shodanki	2026-08-13 23:49:30 (4 weeks ago)	Aug 14 01:48:57 mx1 postfix/smtpd[24026]: lost connection after CONNECT from unknown[165.245.252.131 ... show more Aug 14 01:48:57 mx1 postfix/smtpd[24026]: lost connection after CONNECT from unknown[165.245.252.131] Aug 14 01:49:05 mx1 postfix/smtpd[24026]: lost connection after EHLO from unknown[165.245.252.131] Aug 14 01:49:12 mx1 postfix/smtpd[24026]: lost connection after UNKNOWN from unknown[165.245.252.131] Aug 14 01:49:22 mx1 postfix/smtpd[24026]: lost connection after UNKNOWN from unknown[165.245.252.131] Aug 14 01:49:28 mx1 postfix/smtpd[24026]: lost connection after UNKNOWN from unknown[165.245.252.131] ... show less	Brute-Force Web App Attack SSH
🇺🇸 drewf.ink	2026-08-13 19:36:35 (4 weeks ago)	[19:36] Port scanning. Port(s) scanned: TCP/6000	Port Scan
Anonymous	2026-08-13 13:04:26 (4 weeks ago)	hacking	Hacking
🇺🇸 gu-alvareza	2026-08-13 05:05:08 (4 weeks ago)	Nmap.Script.Scanner	Port Scan
🇩🇪 30p87	2026-08-13 01:50:51 (4 weeks ago)	2026-08-13T03:50:50.237968+02:00 30p87-server sshd-session[3448875]: Connection closed by 165.245.25 ... show more 2026-08-13T03:50:50.237968+02:00 30p87-server sshd-session[3448875]: Connection closed by 165.245.252.131 port 17355 [preauth] ... show less	Brute-Force SSH
🇦🇪 abusiveIntelligence	2026-08-12 23:00:00 (4 weeks ago)	RDP connect attempt: Nmap Scanner	Brute-Force
🇩🇪 MaxMeier	2026-08-12 22:05:39 (4 weeks ago)	165.245.252.131 - - [13/Aug/2026:00:04:33 +0200] "GET / HTTP/1.0" 444 0 "-" "-" 165.245.252.131 - - ... show more 165.245.252.131 - - [13/Aug/2026:00:04:33 +0200] "GET / HTTP/1.0" 444 0 "-" "-" 165.245.252.131 - - [13/Aug/2026:00:04:33 +0200] "OPTIONS / HTTP/1.0" 444 0 "-" "-" 165.245.252.131 - - [13/Aug/2026:00:04:33 +0200] "GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0" 444 0 "-" "-" 165.245.252.131 - - [13/Aug/2026:00:04:33 +0200] "\x00\x00\x07\x00\x08\x00\x03\x00\x04\x00\x05\x00\x06" 400 150 "-" "-" 165.245.252.131 - - [13/Aug/2026:00:04:38 +0200] "" 400 0 "-" "-" 165.245.252.131 - - [13/Aug/2026:00:04:38 +0200] "OPTIONS / RTSP/1.0" 400 150 "-" "-" 165.245.252.131 - - [13/Aug/2026:00:04:38 +0200] "GET /odinhttpcall1786572278 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" 165.245.252.131 - - [13/Aug/2026:00:04:38 +0200] "POST /sdk HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-08-12 21:57:12 (4 weeks ago)	Fail2ban Nginx log integration.	Brute-Force SSH Port Scan
🇸🇪 www.remote24.se	2026-08-12 19:54:36 (4 weeks ago)	3389BruteforceStormFW21	Brute-Force
🇺🇸 Carltonfsck	2026-08-12 19:10:27 (4 weeks ago)	165.245.252.131 - - [12/Aug/2026:19:10:26 +0000] "GET / HTTP/1.0" 400 402 165.245.252.131 - - [12/Au ... show more 165.245.252.131 - - [12/Aug/2026:19:10:26 +0000] "GET / HTTP/1.0" 400 402 165.245.252.131 - - [12/Aug/2026:19:10:26 +0000] "GET / HTTP/1.0" 400 402 165.245.252.131 - - [12/Aug/2026:19:10:26 +0000] "GET / HTTP/1.0" 400 402 ... show less	Hacking Brute-Force
🇩🇪 _ArminS_	2026-08-12 16:02:05 (4 weeks ago)	SP-Scan 52865:143 detected 2026.08.12 18:02:05 blocked until 2026.10.01 11:04:52	Port Scan
🇫🇷 EvoX	2026-08-12 14:51:13 (4 weeks ago)	🛡️ Honeypot [bsts-tpot-hive]: Unauthorized traffic (88 bytes of payload); 6443 [13] TCP	Port Scan
🇳🇱 Eric	2026-08-12 08:58:13 (4 weeks ago)	[Wed Aug 12 08:58:12.475572 2026] [security2:error] [pid 4030864:tid 4030864] [client 165.245.252.13 ... show more [Wed Aug 12 08:58:12.475572 2026] [security2:error] [pid 4030864:tid 4030864] [client 165.245.252.131:16825] [client 165.245.252.131] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "736"] [id "920350"] [msg "Host header is a numeric IP address"] [data "94.209.38.171"] [severity "WARNING"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "94.209.38.171"] [uri "/odinhttpcall1786525092"] [unique_id "anw1pFht-ZfS3E3tyFlyhwAAABQ"] [Wed Aug 12 08:58:12.476439 2026] [security2:error] [pid 3965822:tid 3965822] [client 165.245.252.131:29049] [client 165.245.252.131] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.co ... show less	Hacking Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.107

🇹🇿 196.41.46.194

🇨🇴 186.96.106.156

🇨🇳 106.117.111.206

🇩🇿 105.235.135.55

🇲🇦 105.71.135.239

🇮🇩 103.142.240.142

🇱🇹 62.60.130.242

🇲🇾 49.124.148.200

🇺🇸 43.172.65.55

🇦🇺 27.32.245.98

🇺🇸 195.184.76.48

🇺🇸 135.237.125.183

🇧🇷 108.167.132.74

🇩🇿 105.109.135.170

🇺🇦 87.244.181.186

🇺🇸 73.17.84.119

🇺🇸 70.183.226.82

🇺🇸 52.248.42.195

🇸🇬 47.79.201.221