JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

199.165.159.53

Recent Activity

Abuse confidence score ?

100% Critical

101 reports

58 reporters · latest 20 minutes ago

ISP	The Shadowserver Foundation, Inc.
Usage Type	Commercial
ASN	AS22168
Hostname(s)	scan-96-4.shadowserver.io
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	Pleasanton, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 199.165.159.53

Export CSV

This IP address has been reported a total of 101 times from 58 distinct sources. 199.165.159.53 was first reported on October 5th 2026, and the most recent report was 20 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 43 reports; Germany with 16 reports; Netherlands with 6 reports. The most common categories in these recent reports were: Port Scan 88 times; Hacking 14 times; Brute-Force 10 times; Web App Attack 3 times; Exploited Host 3 times; Other 3 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 chillcog.com	2026-10-09 06:10:14 (20 minutes ago)	Blocked by on honeypot [1080/tcp] \| SPT: 44919 \| TTL: 243 \| LEN: 40 \| TOS: 0x00 • Reported by: abuse ... show more Blocked by on honeypot [1080/tcp] \| SPT: 44919 \| TTL: 243 \| LEN: 40 \| TOS: 0x00 • Reported by: abuse.terraforge.fun show less	Port Scan
🇹🇷 SeczarSecureOps	2026-10-09 05:23:07 (1 hour ago)	Auto-blocked by Seczar SecureOps — Recent High-Profile CVE Exploit Indicators on Public Web Surface ... show more Auto-blocked by Seczar SecureOps — Recent High-Profile CVE Exploit Indicators on Public Web Surface (2 events in 1min) at 2026-10-09 05:23 show less	Hacking
🇺🇸 xmission.com	2026-10-09 04:38:26 (1 hour ago)	Blocked by UFW (TCP on 6516) Source port: 45673 TTL: 246 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 6516) Source port: 45673 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.53) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-10-09 03:48:21 (2 hours ago)	Blocked by UFW (TCP on 31337) Source port: 56979 TTL: 246 Packet length: 40 TOS: 0x00 This report ( ... show more Blocked by UFW (TCP on 31337) Source port: 56979 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.53) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇹🇷 savasboluk	2026-10-09 01:27:51 (5 hours ago)	Auto-blocked by Seczar SecureOps — Crypto Miner / C2 Outbound (4 events in 5min) at 2026-10-09 01:27	Exploited Host
🇺🇸 Aurealize	2026-10-09 01:27:19 (5 hours ago)	firewall port scanning detected. 2 or more observation(s) from 2026-10-09T01:27:19.000Z through 2026 ... show more firewall port scanning detected. 2 or more observation(s) from 2026-10-09T01:27:19.000Z through 2026-10-09T01:27:19.000Z. show less	Port Scan
🇮🇹 CoreTech srl	2026-10-09 00:52:41 (5 hours ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_server_contact,ndpi_unidirectional_traffic,tcp_no_da ... show more [DC: IP:151.1.252.27] ntopng alert: blacklisted_server_contact,ndpi_unidirectional_traffic,tcp_no_data_exchanged,ndpi_tcp_issues,ndpi_probing_attempt show less	Hacking
🇺🇸 COMPLEX	2026-10-09 00:51:57 (5 hours ago)	Unsolicited TCP traffic \| Action: DROP \| Port 8010	Brute-Force
🇫🇮 6kilowatti	2026-10-09 00:51:18 (5 hours ago)	2026-10-09T03:51:17.429071+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74 ... show more 2026-10-09T03:51:17.429071+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74:f4:53:e7:08:00 SRC=199.165.159.53 DST=5.61.88.83 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=TCP SPT=43115 DPT=8010 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 xmission.com	2026-10-09 00:45:48 (5 hours ago)	Blocked by UFW (TCP on 4840) Source port: 53179 TTL: 246 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 4840) Source port: 53179 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.53) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Jochen Pretli	2026-10-08 15:04:35 (15 hours ago)	connection to honeypot	Email Spam Port Scan
🇺🇸 xmission.com	2026-10-08 14:26:14 (16 hours ago)	Blocked by UFW (TCP on 6379) Source port: 57018 TTL: 246 Packet length: 40 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 6379) Source port: 57018 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.53) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 RAP	2026-10-08 13:15:16 (17 hours ago)	2026-10-08 13:15:16 UTC Unauthorized activity to TCP port 445. SMB	Port Scan
🇺🇸 xmission.com	2026-10-08 12:32:10 (17 hours ago)	Blocked by UFW (TCP on 11434) Source port: 43993 TTL: 246 Packet length: 40 TOS: 0x00 This report ( ... show more Blocked by UFW (TCP on 11434) Source port: 43993 TTL: 246 Packet length: 40 TOS: 0x00 This report (for 199.165.159.53) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇨🇭 Elysium Security	2026-10-08 12:19:23 (18 hours ago)	Mass port scanning on a whole network	Port Scan

Showing 1 to 15 of 101 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 2400:8d60:8::96b0:ddfd

🇮🇳 223.178.211.84

🇧🇧 196.3.219.119

🇻🇪 186.14.58.13

🇺🇸 185.98.168.107

🇮🇳 183.83.224.137

🇵🇦 181.197.40.23

🇩🇪 172.71.164.178

🇩🇪 172.70.247.197

🇬🇧 172.68.229.156

🇩🇪 162.158.95.171

🇻🇳 160.30.157.211

🇳🇱 138.226.239.53

🇳🇱 138.226.239.52

🇭🇰 119.28.140.106

🇲🇾 115.164.33.123

🇮🇳 106.219.68.16

🇳🇬 105.118.74.139

🇩🇪 104.23.239.97

🇧🇩 103.171.69.176