199.165.159.98

🇺🇸Pleasanton, California, United States · AS22168 The Shadowserver Foundation, Inc.

Inside 2 reported networks. 199.165.159.0/24 is listed by Firehol Level1 (Listed by raw.githubusercontent.com) Port Scan SSH Vulnerability Scan, last 22 minutes ago; each address inside gets 0.6% of a report. 199.165.159.0/24 is listed by Emergingthreats - Block IP (Listed by rules.emergingthreats.net) Hacking Vulnerability Scan, last 1 hour ago; each address inside gets 0.4% of a report.

A network report is spread across the network: each address receives the report's weight divided by half the number of addresses in it. Small networks weigh a lot, large ones very little.

70%

Abuse confidence: Medium

Reported 10 times by 5 reporters, most recently 6 hours ago.

What it was reported for

Reports

When	Reporter	Categories	Comment
6 hours ago	Automated feed	DNS Poisoning SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Listed by ThreatView.io
6 hours ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
8 hours ago	Automated feed	Web App Attack Command & Control	Listed by raw.githubusercontent.com
18 hours ago	Automated feed	Port Scan Hacking Vulnerability Scan	Listed by raw.githubusercontent.com
18 hours ago	Automated feed	Web Spam Port Scan Bad Web Bot	Listed by raw.githubusercontent.com
34 hours ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
2 days ago	Automated feed	DNS Poisoning SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Listed by ThreatView.io
2 days ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com
4 days ago	Automated feed	DNS Poisoning SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Listed by ThreatView.io
4 days ago	Automated feed	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	Listed by cinsscore.com

Details

Version: IPv4
Tor exit: no
Hostname: scan-63-1.shadowserver.io
ASN: AS22168
Network: The Shadowserver Foundation, Inc.
Country: 🇺🇸 United States
Region: California
City: Pleasanton (approx.)
First seen: 25 Oct 2026
Last seen: 29 Oct 2026

Location and network: IP Geolocation by DB-IP

Reported nearby

Other addresses in the same /24 reported in the last 90 days.

Same lookup from a script

curl -s "https://isipsafe.com/api/v1/check?ip=199.165.159.98"

Check the surrounding /24 · API docs