JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.225.33.22

130.225.33.22 was found in our database!

This IP was reported 79 times. Confidence of Abuse is 100%: ?

100%

ISP	Danmarks Tekniske Universitet
Usage Type	University/College/School
ASN	AS1835
Domain Name	dtu.dk
Country	🇩🇰 Denmark
City	Kongens Lyngby, Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.225.33.22

Whois 130.225.33.22

IP Abuse Reports for 130.225.33.22:

This IP address has been reported a total of 79 times from 62 distinct sources. 130.225.33.22 was first reported on August 25th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 tjs	2026-08-26 12:55:00 (1 hour ago)	web attack, shell attempt	Hacking Web App Attack
🇩🇪 arnisolutions	2026-08-26 12:42:06 (1 hour ago)	Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production s ... show more Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production server. Observed on 1 day(s) between 2026-08-26 and 2026-08-26 (UTC). Sample request: GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 show less	Web App Attack Hacking
Anonymous	2026-08-26 12:30:27 (2 hours ago)	[Wed Aug 26 14:30:26.599989 2026] [proxy_fcgi:error] [pid 21712:tid 21774] [client 130.225.33.22:344 ... show more [Wed Aug 26 14:30:26.599989 2026] [proxy_fcgi:error] [pid 21712:tid 21774] [client 130.225.33.22:34494] AH01071: Got error 'Primary script unknown' [Wed Aug 26 14:30:26.675023 2026] [proxy_fcgi:error] [pid 21712:tid 21775] [client 130.225.33.22:34494] AH01071: Got error 'Primary script unknown' [Wed Aug 26 14:30:26.760242 2026] [proxy_fcgi:error] [pid 21712:tid 21800] [client 130.225.33.22:34494] AH01071: Got error 'Primary script unknown' [Wed Aug 26 14:30:26.835226 2026] [proxy_fcgi:error] [pid 21712:tid 21786] [client 130.225.33.22:34494] AH01071: Got error 'Primary script unknown' [Wed Aug 26 14:30:26.884968 2026] [proxy_fcgi:error] [pid 21712:tid 21778] [client 130.225.33.22:34494] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
🇩🇪 Viveronese	2026-08-26 11:42:37 (2 hours ago)	HTTP vulnerability scanning	Web App Attack
🇫🇷 COMAITE	2026-08-26 09:14:14 (5 hours ago)	PHP CGI-bin vulnerability attempt.	Web App Attack
🇺🇸 MPL	2026-08-26 09:12:16 (5 hours ago)	tcp/443 (4 or more attempts)	Port Scan
🇧🇷 noconex	2026-08-26 08:35:04 (6 hours ago)	Wazuh Alert \| Rule ID: 110100 \| Desc: Suricata: Exploit (ET EXPLOIT Apache HTTP Server 2.4.49 - Path ... show more Wazuh Alert \| Rule ID: 110100 \| Desc: Suricata: Exploit (ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2) 130.225.33.22 show less	Port Scan Brute-Force SSH
🇦🇺 Ticketebo Pty. Ltd.	2026-08-26 08:33:36 (6 hours ago)	Aug 26 18:14:37 mags sshd-session[2426358]: Invalid user admin from 130.225.33.22 port 60596 Aug 26 ... show more Aug 26 18:14:37 mags sshd-session[2426358]: Invalid user admin from 130.225.33.22 port 60596 Aug 26 18:16:29 mags sshd-session[2427223]: Invalid user user from 130.225.33.22 port 48378 Aug 26 18:20:14 mags sshd-session[2428049]: Invalid user user from 130.225.33.22 port 40364 Aug 26 18:26:02 mags sshd-session[2428876]: Invalid user orangepi from 130.225.33.22 port 45490 Aug 26 18:27:57 mags sshd-session[2428908]: Invalid user support from 130.225.33.22 port 54154 Aug 26 18:29:48 mags sshd-session[2428950]: Invalid user admin from 130.225.33.22 port 33314 Aug 26 18:33:35 mags sshd-session[2429884]: Invalid user admin from 130.225.33.22 port 51928 ... show less	Brute-Force
🇩🇪 lenz	2026-08-26 08:17:24 (6 hours ago)	130.225.33.22 - - [26/Aug/2026:10:17:23 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2 ... show more 130.225.33.22 - - [26/Aug/2026:10:17:23 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 226 "-" "libredtail-http" 130.225.33.22 - - [26/Aug/2026:10:17:23 +0200] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 226 "-" "libredtail-http" ... show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-08-26 07:36:56 (7 hours ago)	(mod_security) mod_security (id:218420) triggered by 130.225.33.22 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 130.225.33.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 03:36:49.366158 2026] [security2:error] [pid 27112:tid 27112] [client 130.225.33.22:45146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.151.27:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.151.27"] [uri "/hello.world"] [unique_id "ao6XkcZvst3giO8uWfhoQwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 webadmin	2026-08-26 07:26:28 (7 hours ago)	Failed password for admin from 130.225.33.22 port 60824 ssh2 Connection closed by admin 130.225.33.2 ... show more Failed password for admin from 130.225.33.22 port 60824 ssh2 Connection closed by admin 130.225.33.22 port 60824 [preauth] Failed password for user from 130.225.33.22 port 51478 ssh2 show less	SSH
🇰🇷 xinefps	2026-08-26 07:22:49 (7 hours ago)	Aug 26 16:20:45 icn-home-arm-rpi4b1 sshd[1925975]: Invalid user user from 130.225.33.22 port 58964 A ... show more Aug 26 16:20:45 icn-home-arm-rpi4b1 sshd[1925975]: Invalid user user from 130.225.33.22 port 58964 Aug 26 16:20:45 icn-home-arm-rpi4b1 sshd[1925975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.225.33.22 Aug 26 16:20:47 icn-home-arm-rpi4b1 sshd[1925975]: Failed password for invalid user user from 130.225.33.22 port 58964 ssh2 Aug 26 16:22:45 icn-home-arm-rpi4b1 sshd[1926128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.225.33.22 user=root Aug 26 16:22:48 icn-home-arm-rpi4b1 sshd[1926128]: Failed password for root from 130.225.33.22 port 45724 ssh2 ... show less	Brute-Force SSH
🇩🇪 BlueWire Hosting	2026-08-26 07:02:10 (7 hours ago)	Aggressive scanning resulting into 404	Bad Web Bot
🇺🇸 infra-monitor	2026-08-26 07:00:06 (7 hours ago)	Automated ban via infra-monitor: webshell-high-confidence, php-obscure-path-backdoor, crowdsecurity/ ... show more Automated ban via infra-monitor: webshell-high-confidence, php-obscure-path-backdoor, crowdsecurity/CVE-2017-9841, +1 more show less	Port Scan Hacking Web App Attack
🇫🇮 Phish.gg	2026-08-26 06:56:04 (7 hours ago)	Aug 26 06:54:11 obsidian sshd[2995225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ... show more Aug 26 06:54:11 obsidian sshd[2995225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.225.33.22 Aug 26 06:54:13 obsidian sshd[2995225]: Failed password for invalid user admin from 130.225.33.22 port 36468 ssh2 Aug 26 06:56:03 obsidian sshd[2997942]: Invalid user user from 130.225.33.22 port 34802 ... show less	Brute-Force SSH

Showing 1 to 15 of 79 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2400:cb00:119:1000:5286:1dc4:ab55:f7ec

🇩🇪 213.209.159.154

🇹🇼 203.75.170.63

🇺🇸 172.208.48.177

🇺🇸 147.185.132.28

🇮🇳 106.51.48.20

🇺🇸 104.209.144.33

🇻🇳 103.205.107.170

🇺🇸 66.240.236.109

🇷🇴 193.46.255.86

🇳🇱 192.42.116.49

🇺🇸 172.68.174.185

🇺🇦 91.237.243.94

🇨🇦 76.11.102.122

🇺🇸 9.129.0.1

🇭🇰 152.32.226.205

🇨🇳 123.129.103.134

🇻🇳 116.110.149.203

🇩🇪 47.254.171.212

🇪🇸 46.24.47.94