JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 167.99.254.106

167.99.254.106 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 167.99.254.106

Whois 167.99.254.106

IP Abuse Reports for 167.99.254.106:

This IP address has been reported a total of 30 times from 24 distinct sources. 167.99.254.106 was first reported on April 16th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 HeliJP	2026-06-11 11:35:54 (1 day ago)	Identified as SPAM from IP address 167.99.254.106	Email Spam
🇩🇪 dispaisyenterprises	2026-06-11 08:39:48 (1 day ago)	Honeypot [fra-de-honeypot]: Empty payload (likely service probe); 1911 [16] TCP Reported by DisPaisy ... show more Honeypot [fra-de-honeypot]: Empty payload (likely service probe); 1911 [16] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇩🇪 licen777	2026-06-11 07:30:38 (1 day ago)	Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-06-11T07:29:37Z and 2026-06-1 ... show more Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-06-11T07:29:37Z and 2026-06-11T07:30:37Z show less	Brute-Force SSH
🇯🇵 mkaraki	2026-06-11 01:58:20 (1 day ago)	1781143098 # Service_probe # SIGNATURE_SEND # source_ip:167.99.254.106 # dst_port:23 ...	Port Scan
🇹🇷 Threat.live	2026-06-10 23:05:03 (1 day ago)	Threat.live: Web Scan	Web App Attack
🇺🇦 llighthunter	2026-06-10 23:00:56 (1 day ago)	Jun 9 10:15:09 mail postfix/smtps/smtpd[17181]: lost connection after CONNECT from unknown[167.99.2 ... show more Jun 9 10:15:09 mail postfix/smtps/smtpd[17181]: lost connection after CONNECT from unknown[167.99.254.106] Jun 9 10:15:23 mail postfix/smtps/smtpd[17181]: lost connection after EHLO from unknown[167.99.254.106] show less	Hacking SSH
🇨🇿 sajmon0011	2026-06-10 17:46:32 (2 days ago)	167.99.254.106 - - [10/Jun/2026:19:46:31 +0200] "GET /odinhttpcall1781113591 HTTP/1.1" 404 196 "-" " ... show more 167.99.254.106 - - [10/Jun/2026:19:46:31 +0200] "GET /odinhttpcall1781113591 HTTP/1.1" 404 196 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" ... show less	Web App Attack
🇬🇧 PeravixGroup	2026-06-10 15:20:10 (2 days ago)	Honeypot detection: Kubernetes API unauthorized access / cluster abuse attempt on port 6443. Severit ... show more Honeypot detection: Kubernetes API unauthorized access / cluster abuse attempt on port 6443. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇫🇷 Thaliruth	2026-06-10 09:57:00 (2 days ago)	Jun 10 11:56:59 151 postfix/smtpd[3727256]: lost connection after CONNECT from unknown[167.99.254.10 ... show more Jun 10 11:56:59 151 postfix/smtpd[3727256]: lost connection after CONNECT from unknown[167.99.254.106] ... show less	Hacking Brute-Force
🇩🇪 paissangroup	2026-06-10 02:45:04 (2 days ago)	Multiple WAF Violations	Web App Attack
🇳🇴 Bots.go.to.hell	2026-06-10 02:21:44 (2 days ago)	This IP was detected by CrowdSec triggering custom/ip-honeypot	Web App Attack Bad Web Bot
🇩🇪 dispaisyenterprises	2026-06-10 02:05:03 (2 days ago)	Honeypot [fra-de-honeypot]: Brute-force attack detected on 23/TELNET • Credentials: GET / HTTP/1.0:, ... show more Honeypot [fra-de-honeypot]: Brute-force attack detected on 23/TELNET • Credentials: GET / HTTP/1.0:, OPTIONS / HTTP/1.0:, OPTIONS / RTSP/1.0:, OPTIONS sip:nm SIP/2.0:Via: SIP/2.0/TCP nm;branch=foo, From: <sip:nm@nm>;tag=root:To: <sip:nm2@nm2>, Call-ID: 50000:CSeq: 42 OPTIONS, Max-Forwards: 70:Content-Length: 0, Contact: <sip:nm@nm>:Accept: application/sdp • Number of login attempts: 8 Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Brute-Force Hacking
🇩🇪 Lazentis	2026-06-10 00:45:57 (2 days ago)	Unauthorized access attempt to port 8080 (tcp)	Brute-Force SSH
🇬🇧 PeravixGroup	2026-06-09 16:46:57 (3 days ago)	Honeypot detection: SIP/VoIP unauthorized registration / call routing abuse attempt on port 143. Sev ... show more Honeypot detection: SIP/VoIP unauthorized registration / call routing abuse attempt on port 143. Severity: HIGH. Aaran.cloud show less	Hacking Brute-Force
Anonymous	2026-06-09 09:52:07 (3 days ago)	Reported from Nginx log analysis 16. Log: 167.99.254.106 - - [09/Jun/2026:xx:xx:xx 0200] "GET / HTT ... show more Reported from Nginx log analysis 16. Log: 167.99.254.106 - - [09/Jun/2026:xx:xx:xx 0200] "GET / HTTP/1.0" xxx xxx "-" "-" "-" "DE Germany Frankfurt am Main" "AS14061" "DigitalOcean, LLC" show less	Port Scan Brute-Force SSH

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 186.81.100.45

🇧🇬 185.255.212.137

🇨🇳 183.199.245.117

🇨🇳 183.66.166.30

🇺🇸 104.28.233.73

🇰🇷 59.26.193.177

🇳🇱 45.153.34.235

🇪🇸 45.135.196.79

🇺🇸 44.197.219.42

🇺🇸 216.73.160.229

🇧🇷 205.210.31.193

🇰🇿 195.49.212.189

🇨🇦 158.69.227.40

🇵🇾 143.255.140.220

🇨🇳 111.173.158.217

🇨🇳 103.85.174.162

🇹🇷 91.151.95.146

🇹🇷 85.99.115.219

🇫🇷 54.37.229.48

🇫🇷 51.178.43.161