JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 4.223.159.54

4.223.159.54 was found in our database!

This IP was reported 59 times. Confidence of Abuse is 0%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇸🇪 Sweden
City	Gavle, Gavleborg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 4.223.159.54

Whois 4.223.159.54

IP Abuse Reports for 4.223.159.54:

This IP address has been reported a total of 59 times from 48 distinct sources. 4.223.159.54 was first reported on August 7th 2025, and the most recent report was 10 months ago.

Old Reports: The most recent abuse report for this IP address is from 10 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2025-08-08 23:26:01 (10 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/4.223.159.54	Brute-Force
🇦🇹 urnilxfgbez	2025-08-08 22:45:00 (10 months ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇩🇪 formality	2025-08-08 06:44:52 (10 months ago)	Invalid user siapbot from 4.223.159.54 port 58702	Brute-Force SSH
🇺🇸 bigscoots.com	2025-08-08 06:13:10 (10 months ago)	(sshd) Failed SSH login from 4.223.159.54 (SE/Sweden/-): 5 in the last 3600 secs; Ports: ; Directio ... show more (sshd) Failed SSH login from 4.223.159.54 (SE/Sweden/-): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Aug 8 06:12:45 23577 sshd[6226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.223.159.54 user=root Aug 8 06:12:47 23577 sshd[6226]: Failed password for root from 4.223.159.54 port 54898 ssh2 Aug 8 06:12:51 23577 sshd[6232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.223.159.54 user=root Aug 8 06:12:53 23577 sshd[6232]: Failed password for root from 4.223.159.54 port 54902 ssh2 Aug 8 06:12:57 23577 sshd[6234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.223.159.54 user=root show less	Brute-Force SSH
🇳🇱 Valentin Ivanov	2025-08-08 06:11:14 (10 months ago)	2025-08-08T02:11:04.858415monsters1 sshd[25482]: Failed password for root from 4.223.159.54 port 609 ... show more 2025-08-08T02:11:04.858415monsters1 sshd[25482]: Failed password for root from 4.223.159.54 port 60956 ssh2 2025-08-08T02:11:08.938286monsters1 sshd[25485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.223.159.54 user=root 2025-08-08T02:11:10.888284monsters1 sshd[25485]: Failed password for root from 4.223.159.54 port 60964 ssh2 2025-08-08T02:11:11.155097monsters1 sshd[25487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.223.159.54 user=root 2025-08-08T02:11:13.516320monsters1 sshd[25487]: Failed password for root from 4.223.159.54 port 60974 ssh2 ... show less	Brute-Force SSH
🇳🇴 kipfel★	2025-08-08 06:07:01 (10 months ago)	2025-08-08T08:06:20.537730+02:00 gigahost-vm-cm21-2c2g-sfj sshd[1064183]: Invalid user developer fro ... show more 2025-08-08T08:06:20.537730+02:00 gigahost-vm-cm21-2c2g-sfj sshd[1064183]: Invalid user developer from 4.223.159.54 port 39102 2025-08-08T08:06:59.220592+02:00 gigahost-vm-cm21-2c2g-sfj sshd[1064244]: Invalid user ansible from 4.223.159.54 port 51944 2025-08-08T08:07:00.764935+02:00 gigahost-vm-cm21-2c2g-sfj sshd[1064254]: Invalid user ubuntu from 4.223.159.54 port 51988 ... show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-08-08 06:04:09 (10 months ago)	(mod_security) mod_security (id:218420) triggered by 4.223.159.54 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 4.223.159.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 08 02:04:04.877911 2025] [security2:error] [pid 8134:tid 8134] [client 4.223.159.54:35442] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.151.16:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.151.16"] [uri "/hello.world"] [unique_id "aJWTVPNhE0gFTmW8No75TwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 [email protected]	2025-08-08 05:51:39 (10 months ago)	2025-08-08T05:51:37.929294+00:00 mothma sshd[654931]: Failed password for root from 4.223.159.54 por ... show more 2025-08-08T05:51:37.929294+00:00 mothma sshd[654931]: Failed password for root from 4.223.159.54 port 32788 ssh2 2025-08-08T05:51:38.419736+00:00 mothma sshd[654931]: Connection closed by authenticating user root 4.223.159.54 port 32788 [preauth] 2025-08-08T05:51:39.043372+00:00 mothma sshd[654945]: Invalid user ftpuser from 4.223.159.54 port 38648 ... show less	Brute-Force SSH
🇵🇱 Portuseco Biling	2025-08-08 05:49:09 (10 months ago)	4VPS-F2B blocked SSH BF-	Brute-Force SSH
🇵🇱 Niko's Stuff	2025-08-08 05:34:53 (10 months ago)	[1x] F2B \| Suspicious activity blocked on: ufw \| BanTime: 604800s \| Suspicious TCP packet from 4.223 ... show more [1x] F2B \| Suspicious activity blocked on: ufw \| BanTime: 604800s \| Suspicious TCP packet from 4.223.159.54:50809 → port 2222 \| TTL: 40, LEN: 40, TOS: 0x00, PREC: 0x00, Interface: eth0 show less	Port Scan
🇧🇷 vfAcceloReporter	2025-08-08 05:29:25 (10 months ago)	4.223.159.54 - - [08/Aug/2025:02:29:25 -0300] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.p ... show more 4.223.159.54 - - [08/Aug/2025:02:29:25 -0300] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" ... show less	Brute-Force Exploited Host Web App Attack
🇫🇷 security.rdmc.fr	2025-08-08 05:16:42 (10 months ago)	Port Scan Attack proto:TCP src:45762 dst:23	Port Scan
🇬🇧 djboddington	2025-08-08 05:11:34 (10 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/ssh-bf	Brute-Force SSH
🇩🇪 LRob.fr	2025-08-08 05:00:01 (10 months ago)	SSH abuse or brute-force attack detected by Fail2Ban in ssh jail	Brute-Force SSH
🇩🇪 formality	2025-08-08 04:45:57 (10 months ago)	Invalid user vpn from 4.223.159.54 port 36914	Brute-Force SSH

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.31

🇺🇸 195.250.25.176

🇺🇸 193.3.53.3

🇨🇳 182.42.113.10

🇰🇷 110.14.192.20

🇺🇸 65.60.158.138

🇳🇱 45.148.10.141

🇯🇵 8.216.5.140

🇯🇵 2620:171:a4:f003:9999::244

🇨🇳 222.128.28.56

🇧🇪 198.235.24.243

🇩🇪 185.216.214.42

🇳🇱 91.92.40.27

🇸🇬 43.128.120.247

🇫🇷 13.140.172.33

🇺🇸 216.25.89.88

🇷🇺 213.183.120.56

🇰🇷 211.178.247.182

🇪🇸 185.18.198.185

🇵🇾 181.123.136.11