JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

199.165.159.48

Recent Activity

Abuse confidence score ?

100% Critical

87 reports

53 reporters · latest 36 minutes ago

ISP	The Shadowserver Foundation, Inc.
Usage Type	Commercial
ASN	AS22168
Hostname(s)	scan-95-7.shadowserver.io
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	Pleasanton, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 199.165.159.48

Export CSV

This IP address has been reported a total of 87 times from 53 distinct sources. 199.165.159.48 was first reported on October 5th 2026, and the most recent report was 36 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 39 reports; Germany with 13 reports; Russian Federation with 4 reports. The most common categories in these recent reports were: Port Scan 76 times; Hacking 20 times; Brute-Force 10 times; Web App Attack 6 times; Exploited Host 4 times; Other 4 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 seajaydaboi36	2026-10-08 01:55:21 (36 minutes ago)	Automated detection: unsolicited connection to Pterodactyl Wings server.	Port Scan Hacking Brute-Force
🇩🇪 bescared	2026-10-08 01:55:21 (36 minutes ago)	F2B - Malicious activity detected. Excessive port scans. -8ff06ede-	Port Scan
🇩🇪 xserverx.ru	2026-10-08 01:43:49 (48 minutes ago)	[UFW SCAN!!!!] SRC=199.165.159.48 LEN=40 TOS=0x00 PREC=0x00 TTL=235 PROTO=TCP SPT=58483 DPT=6080 WIN ... show more [UFW SCAN!!!!] SRC=199.165.159.48 LEN=40 TOS=0x00 PREC=0x00 TTL=235 PROTO=TCP SPT=58483 DPT=6080 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 xmission.com	2026-10-08 01:43:38 (48 minutes ago)	Blocked by UFW (TCP on 6080) Source port: 59406 TTL: 246 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 6080) Source port: 59406 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.48) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇮🇹 CoreTech srl	2026-10-08 01:21:09 (1 hour ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_server_contact,ndpi_unidirectional_traffic,tcp_no_da ... show more [DC: IP:151.1.252.27] ntopng alert: blacklisted_server_contact,ndpi_unidirectional_traffic,tcp_no_data_exchanged,ndpi_tcp_issues,tcp_flow_reset,ndpi_probing_attempt show less	Hacking
🇺🇸 xmission.com	2026-10-08 01:11:03 (1 hour ago)	Blocked by UFW (TCP on 801) Source port: 56849 TTL: 246 Packet length: 40 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 801) Source port: 56849 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.48) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 sonot	2026-10-07 14:28:46 (12 hours ago)	Blocked by UFW on mail [4911/tcp] \| SPT: 47193 \| TTL: 236 \| LEN: 40 \| TOS: 0x00 • Reported by: githu ... show more Blocked by UFW on mail [4911/tcp] \| SPT: 47193 \| TTL: 236 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇷🇺 genokrad	2026-10-07 14:13:36 (12 hours ago)	Unauthorized connection try on TCP/3389 (RDP)	Port Scan
🇨🇦 polycoda	2026-10-07 14:08:17 (12 hours ago)	AutoBlock: 📡 Port Scan (Non Decay-Based)	Port Scan
🇺🇸 xmission.com	2026-10-07 14:06:54 (12 hours ago)	Blocked by UFW (TCP on 2000) Source port: 32942 TTL: 246 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 2000) Source port: 32942 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.48) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 etu brutus	2026-10-07 14:01:42 (12 hours ago)	199.165.159.48 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
🇩🇪 David Ferneding	2026-10-07 14:01:40 (12 hours ago)	Blocked by UFW (TCP on 1200) Source port: 51131 TTL: 236 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 1200) Source port: 51131 TTL: 236 Packet length: 40 TOS: 0x00 This report (for 199.165.159.48) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 london2038.com	2026-10-07 14:01:30 (12 hours ago)	Connection atttempts against closed TCP ports Oct 7 10:20:03 BLOCK SRC=199.165.159.48 LEN=40 TOS=0x ... show more Connection atttempts against closed TCP ports Oct 7 10:20:03 BLOCK SRC=199.165.159.48 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=TCP SPT=37576 DPT=8443 WINDOW=65535 RES=0x00 SYN Oct 7 11:08:37 BLOCK SRC=199.165.159.48 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=TCP SPT=52026 DPT=9999 WINDOW=65535 RES=0x00 SYN Oct 7 16:01:28 BLOCK SRC=199.165.159.48 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=TCP SPT=35743 DPT=1200 WINDOW=65535 RES=0x00 SYN show less	Port Scan
🇨🇭 SOC [GOLINE SA]	2026-10-07 14:00:01 (12 hours ago)	IDS Alert: ET CINS Active Threat Intelligence Poor Reputation IP group 283 === ATTACK === Signature: ... show more IDS Alert: ET CINS Active Threat Intelligence Poor Reputation IP group 283 === ATTACK === Signature: ET CINS Active Threat Intelligence Poor Reputation IP group 283 \| SID: 2403582 \| Severity: 2 \| Category: Misc Attack === SOURCE === IP: 199.165.159.48 (IPv4) \| Port: 53391 \| Country: United States \| ISP: SSF-NET-SF401 \| rDNS: scan-95-7.shadowserver.io === TARGET === Host: insightvm.goline.ch \| IP: 185.54.80.24 \| Port: 4369 \| Protocol: TCP \| App: N/A === RESPONSE === Time: 2026-10-07 16:00:00 \| Action: Blocked show less	Exploited Host Hacking
🇦🇹 Pingger Shikkoken	2026-10-07 13:46:28 (12 hours ago)	2026-10-07T13:46:28+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT= MAC=b6:ab:74:e6 ... show more 2026-10-07T13:46:28+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT= MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=199.165.159.48 DST=152.53.50.28 LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=54321 PROTO=TCP SPT=40759 DPT=49668 WINDOW=65535 RES=0x00 SYN URGP=0 show less	Hacking

Showing 1 to 15 of 87 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.91

🇺🇸 149.40.50.114

🇹🇭 147.50.231.135

🇺🇸 66.240.192.138

🇺🇸 64.62.197.74

🇷🇴 2.57.122.168

🇩🇪 217.60.196.155

🇩🇪 213.209.159.108

🇮🇩 202.158.36.50

🇻🇪 200.8.121.103

🇵🇪 161.132.54.218

🇺🇸 149.40.50.110

🇳🇱 91.92.42.132

🇧🇬 89.190.218.33

🇷🇺 80.251.156.20

🇺🇸 43.173.73.95

🇸🇦 37.104.221.13

🇺🇸 18.217.208.51

🇻🇳 2405:4802:90fc:8e90:2ca3:ceb8:41e0:8f3

🇨🇱 201.188.193.186