JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.184.122.214

185.184.122.214 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 100%: ?

100%

ISP	u1host ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213877
Hostname(s)	vm931537.hosted-by.u1host.com
Domain Name	u1host.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.184.122.214

Whois 185.184.122.214

IP Abuse Reports for 185.184.122.214:

This IP address has been reported a total of 35 times from 20 distinct sources. 185.184.122.214 was first reported on June 25th 2026, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-30 19:22:53 (20 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com) ... show more (mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 15:22:49.137586 2026] [security2:error] [pid 17976:tid 17976] [client 185.184.122.214:37986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "infodevman.net"] [uri "/.env"] [unique_id "akQXiXjEuynrOsTVKFKMWQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 19:00:00 (20 hours ago)	Aggressive web scan	Web App Attack
🇳🇱 e.fierstra	2026-06-30 18:52:31 (20 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
Anonymous	2026-06-30 17:29:52 (22 hours ago)	(caddyscan) Scanner path probe from 185.184.122.214 (DE/Germany/vm931537.hosted-by.u1host.com): 5 in ... show more (caddyscan) Scanner path probe from 185.184.122.214 (DE/Germany/vm931537.hosted-by.u1host.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 185.184.122.214 - - [30/Jun/2026:17:29:45 +0000] "GET /.env.production.local HTTP/1.1" [REDACTED] 200 2627 185.184.122.214 - - [30/Jun/2026:17:29:46 +0000] "GET /.env.development.local HTTP/1.1" [REDACTED] 200 2627 185.184.122.214 - - [30/Jun/2026:17:29:46 +0000] "GET /.env.test.local HTTP/1.1" [REDACTED] 200 2627 185.184.122.214 - - [30/Jun/2026:17:29:48 +0000] "GET /app/.env HTTP/1.1" [REDACTED] 200 2627 185.184.122.214 - - [30/Jun/2026:17:29:48 +0000] "GET /src/.env HTTP/1.1" show less	Port Scan
🇬🇧 Oakley	2026-06-30 16:57:49 (22 hours ago)	(confirmed_bot_sig) Confirmed bot	Hacking
🇺🇸 TPI-Abuse	2026-06-30 16:12:49 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com) ... show more (mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 12:12:43.716605 2026] [security2:error] [pid 18347:tid 18347] [client 185.184.122.214:40176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pnp42.com.grancanariaholidays.com"] [uri "/.env.dist"] [unique_id "akPq-6vY_0pHvvyTHrxWKQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 15:49:27 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com) ... show more (mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 11:49:23.777535 2026] [security2:error] [pid 15794:tid 15794] [client 185.184.122.214:47110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drkerryklett.com"] [uri "/.env.development"] [unique_id "akPlg7vu9KQUBr-yMYxjpAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-06-30 15:03:55 (1 day ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 SCHAPPY	2026-06-30 14:30:06 (1 day ago)	Brute-force attack to identify web exploits	Brute-Force Web App Attack
🇳🇱 lns.bz	2026-06-30 13:36:47 (1 day ago)	.env scanning [DOPP]	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 12:41:45 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com) ... show more (mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 08:41:37.623572 2026] [security2:error] [pid 328:tid 328] [client 185.184.122.214:33634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ctrl-p.saltcityprint.com"] [uri "/server/.env"] [unique_id "akO5gTuLYzytjZ9Ipb3cwwAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 11:52:14 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com) ... show more (mod_security) mod_security (id:210730) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 07:52:10.154910 2026] [security2:error] [pid 14065:tid 14065] [client 185.184.122.214:45084] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.byles.net\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.byles.net"] [uri "/config/master.key"] [unique_id "akOt6o1q8R75sns-KxvYPgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 09:53:39 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com) ... show more (mod_security) mod_security (id:210492) triggered by 185.184.122.214 (vm931537.hosted-by.u1host.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 05:53:33.173904 2026] [security2:error] [pid 17293:tid 17293] [client 185.184.122.214:54358] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.grandriverhomes.com"] [uri "/.env.development"] [unique_id "akOSHZ7defMqnNBCK3y44wAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 09:11:19 (1 day ago)	[30/Jun/2026:12:11:18 +0300] 178281067819.983413 185.184.122.214 49202 148.251.76.218 443 [30/Jun/20 ... show more [30/Jun/2026:12:11:18 +0300] 178281067819.983413 185.184.122.214 49202 148.251.76.218 443 [30/Jun/2026:12:11:18 +0300] 178281067838.739389 185.184.122.214 49202 148.251.76.218 443 show less	Web App Attack
🇫🇷 dynamix	2026-06-30 09:06:51 (1 day ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4001:c13::12e

🇬🇧 193.163.125.7

🇺🇸 173.208.169.5

🇱🇹 81.30.98.44

🇺🇸 66.132.195.26

🇨🇳 61.134.183.224

🇺🇸 45.207.181.73

🇨🇳 8.148.232.140

🇮🇳 223.233.84.221

🇨🇴 190.27.158.126

🇨🇴 181.129.41.162

🇫🇷 146.88.238.251

🇨🇳 111.61.175.118

🇹🇷 94.154.43.66

🇩🇪 94.16.17.140

🇱🇹 81.30.98.49

🇭🇰 46.247.61.67

🇺🇸 37.140.223.203

🇨🇳 27.185.68.75

🇺🇸 20.64.104.70