199.165.159.25
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- The Shadowserver Foundation, Inc.
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS22168
- Hostname(s)
- scan-93-0.shadowserver.io
- Domain Name
- shadowserver.org
- Country
- 🇺🇸 United States of America
- City
- San Jose, California
Abuse Reports
Total reports
2,554 from
507 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇺🇸 donarev419 |
Connection to port 8530 with data transfer.
Data preview: GET / HTTP/1.1
Host: 167.253.66.144:8530
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_
|
Port Scan Hacking | |
| 🇺🇸 donarev419 |
Connection to port 4081 with data transfer.
Data preview:
|
Port Scan Hacking | |
| 🇺🇸 donarev419 |
Connection to port 800 with data transfer.
Data preview: GET / HTTP/1.1
Host: 107.175.212.44:800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7
|
Port Scan Hacking | |
| 🇳🇱 venix |
Unauthorized connection attempt detected from IP address 199.165.159.25 to port 8080 (web01.amsterdam)
|
Brute-Force Exploited Host | |
| 🇮🇪 AutosOnShow |
blocked for webapp attack | path requested: /geoserver/web/ | seen at 2026-11-14 03:14:35.251 |
|
Web App Attack | |
| 🇫🇷 Feelautom |
[FeelAutom Auto-Ban] DirectIpScan: /fonts/ftnt-icons.woff (Score: 200)
|
Hacking | |
| 🇩🇪 throny |
|
Bad Web Bot | |
| 🇹🇷 pashait |
Seczar SecureOps — Threat Intel IOC Match (2 events) — quarantined 43200m
|
Exploited Host | |
| 🇮🇪 AutosOnShow |
blocked for webapp attack | path requested: / | seen at 2026-11-14 02:44:20.731 |
|
Web App Attack | |
| 🇫🇷 EvoX |
🛡️ Honeypot [bsts-tpot-sensor]: Unauthorized traffic (128 bytes of payload); 23856 [1] TCP
|
Port Scan | |
| 🇲🇳 Public CSIRT/CC of Mongolia |
Honeypot hit: HTTP/1.1 request on 9998
GET /
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip; 9998 [1] TCP
|
Web App Attack | |
| 🇵🇷 HRCOM |
|
Hacking IoT Targeted | |
| 🇺🇸 donarev419 |
Connection to port 5002 with data transfer.
Data preview:
|
Port Scan Hacking | |
| 🇦🇺 LiftUp Hosting |
Honeypot hit: HTTP/1.1 request on 2095
GET /
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Encoding: gzip; 2095 [1] TCP
|
Hacking Bad Web Bot | |
| Anonymous |
Heralding honeypot: smtp on port 25
|
Email Spam Brute-Force |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown