199.165.159.185

🇺🇸Pleasanton, California, United States · AS22168 The Shadowserver Foundation, Inc.

79%

Abuse confidence: High

Reported 52 times by 7 reporters, most recently 8 hours ago.

What it was reported for

Reports

When	Reporter	Categories	Comment
8 hours ago	Automated feed	Web Spam Port Scan Bad Web Bot	Listed by raw.githubusercontent.com
8 hours ago	Automated feed	Port Scan Hacking Vulnerability Scan	Listed by raw.githubusercontent.com
17 hours ago	Automated feed	Web App Attack Command & Control	Listed by raw.githubusercontent.com
21 hours ago	Automated feed	Web App Attack Command & Control HTTP Flood	Listed by www.nubi-network.com
23 hours ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
32 hours ago	Automated feed	Web Spam Port Scan Bad Web Bot	Listed by raw.githubusercontent.com
32 hours ago	Automated feed	Port Scan Hacking Vulnerability Scan	Listed by raw.githubusercontent.com
41 hours ago	Automated feed	Web App Attack Command & Control	Listed by raw.githubusercontent.com
45 hours ago	Automated feed	DNS Poisoning SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Listed by ThreatView.io
47 hours ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
2 days ago	Automated feed	Web App Attack Command & Control HTTP Flood	Listed by www.nubi-network.com
2 days ago	Automated feed	Web Spam Port Scan Bad Web Bot	Listed by raw.githubusercontent.com
2 days ago	Automated feed	Port Scan Hacking Vulnerability Scan	Listed by raw.githubusercontent.com
2 days ago	Automated feed	Web App Attack Command & Control	Listed by raw.githubusercontent.com
2 days ago	Automated feed	DNS Poisoning SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Listed by ThreatView.io
2 days ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
3 days ago	Automated feed	Web App Attack Command & Control HTTP Flood	Listed by www.nubi-network.com
3 days ago	Automated feed	Web Spam Port Scan Bad Web Bot	Listed by raw.githubusercontent.com
3 days ago	Automated feed	Port Scan Hacking Vulnerability Scan	Listed by raw.githubusercontent.com
3 days ago	Automated feed	Web App Attack Command & Control	Listed by raw.githubusercontent.com
3 days ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
4 days ago	Automated feed	Web App Attack Command & Control HTTP Flood	Listed by www.nubi-network.com
4 days ago	🇩🇪Wavecentric bulk	Bad Web Bot Vulnerability Scan	Admin Panel / CMS Scanner - GET /geoserver/web/ (blocked at edge)
4 days ago	Automated feed	Web Spam Port Scan Bad Web Bot	Listed by raw.githubusercontent.com
4 days ago	Automated feed	Port Scan Hacking Vulnerability Scan	Listed by raw.githubusercontent.com

Details

Version: IPv4
Tor exit: no
Hostname: scan-86-0.shadowserver.io
ASN: AS22168
Network: The Shadowserver Foundation, Inc.
Country: 🇺🇸 United States
Region: California
City: Pleasanton (approx.)
First seen: 25 Oct 2026
Last seen: 5 Nov 2026

Location and network: IP Geolocation by DB-IP

Reported nearby

Other addresses in the same /24 reported in the last 90 days.

Same lookup from a script

curl -s "https://isipsafe.com/api/v1/check?ip=199.165.159.185"

Check the surrounding /24 · API docs