JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.195.233.242

185.195.233.242 was found in our database!

This IP was reported 52 times. Confidence of Abuse is 38%: ?

38%

ISP	31173 Services AB infrastructure in Stockholm, SE.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS39351
Domain Name	31173.se
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.195.233.242

Whois 185.195.233.242

IP Abuse Reports for 185.195.233.242:

This IP address has been reported a total of 52 times from 36 distinct sources. 185.195.233.242 was first reported on February 4th 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Octopuce	2026-08-27 16:44:36 (1 day ago)	Aggressive web search of vulnerable pages: /swagger-ui/ /redoc/ /swagger/ /wp-content/plugins/api-do ... show more Aggressive web search of vulnerable pages: /swagger-ui/ /redoc/ /swagger/ /wp-content/plugins/api-docs/ /wp-content/plugins/docs/ /wp-content/p ... show less	Web App Attack
Anonymous	2026-08-26 07:10:45 (2 days ago)	[26/Aug/2026:17:10:44 +1000] "GET /%2A~1%2A%5Ca.aspx HTTP/1.1" 404 236 "Mozilla/5.0 (X11; Linux x86_ ... show more [26/Aug/2026:17:10:44 +1000] "GET /%2A~1%2A%5Ca.aspx HTTP/1.1" 404 236 "Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0" [26/Aug/2026:17:10:44 +1000] "GET /~1/a.aspx HTTP/1.1" 404 236 "Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0" show less	Hacking Web App Attack
🇧🇪 Lunix	2026-08-24 15:06:41 (4 days ago)		Brute-Force Web App Attack
🇺🇸 HamSammich	2026-08-24 00:14:27 (5 days ago)	Automated sensor: 1 HTTP connection/probe attempts over the last 24h (latest 2026-08-24T00:14Z).	Brute-Force Web App Attack
Anonymous	2026-08-23 23:27:02 (5 days ago)	[24/Aug/2026:09:27:00 +1000] "GET /src/.git/config HTTP/1.1" 404 236 "Mozilla/5.0 (compatible; recon ... show more [24/Aug/2026:09:27:00 +1000] "GET /src/.git/config HTTP/1.1" 404 236 "Mozilla/5.0 (compatible; recon-ffuf/1.0)" [24/Aug/2026:09:27:00 +1000] "GET /dev/.git/config HTTP/1.1" 404 236 "Mozilla/5.0 (compatible; recon-ffuf/1.0)" show less	Hacking Web App Attack
🇩🇪 ManagedStack	2026-08-21 11:45:02 (1 week ago)	Probing access to unauthorized locations	Hacking Exploited Host Web App Attack
🇩🇪 HandyTreff.de	2026-08-05 22:29:58 (3 weeks ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -86.175 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -86.175 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Sa show less	Web App Attack Bad Web Bot
Anonymous	2026-07-06 12:03:45 (1 month ago)	185.195.233.242 46.39.185.24 - [06/Jul/2026:14:03:42 +0200] "GET /.env HTTP/2.0" 404 158 "-" "Mozill ... show more 185.195.233.242 46.39.185.24 - [06/Jul/2026:14:03:42 +0200] "GET /.env HTTP/2.0" 404 158 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 07:45:44 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 185.195.233.242 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.195.233.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 03:45:38.325870 2026] [security2:error] [pid 27989:tid 27989] [client 185.195.233.242:54420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.104"] [uri "/.env.dev"] [unique_id "aipnorV2cG_3_5jfobu10AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 07:14:04 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 185.195.233.242 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.195.233.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 03:13:59.521823 2026] [security2:error] [pid 7204:tid 7204] [client 185.195.233.242:34528] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.59"] [uri "/.env.dev"] [unique_id "aipgN6m0N586axEAobTHoAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Viveronese	2026-05-30 07:20:40 (2 months ago)	HTTP vulnerability scanning	Web App Attack
🇫🇷 Tilellit.PRO	2026-05-27 13:09:54 (3 months ago)	Fail2Ban banned 185.195.233.242 for security violations in jail nginx-aggressive. Log: 2026/05/27 13 ... show more Fail2Ban banned 185.195.233.242 for security violations in jail nginx-aggressive. Log: 2026/05/27 13:09:54 [error] FastCGI sent in stderr: "Primary script unknown" , client: 185.195.233.242, server: [REDACTED], request: "GET /trabajo-y-practicas/wp-login.php?action=lostpassword HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "http://www.espsformacion.com/trabajo-y-practicas/wp-login.php?action=lostpassword" 2026/05/27 13:09:54 [error] FastCGI sent in stderr: "Primary script unknown" , client: 185.195.233.242, server: [REDACTED], request: "GET /trabajo-y-practicas/wp-login.php?action=lostpassword%27 HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "http://www.espsformacion.com/trabajo-y-practicas/wp-login.php?action=lostpassword%27" ... show less	Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-05-14 17:23:53 (3 months ago)	20 attempts against mh_ha-misbehave-ban on lime	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-27 00:33:29 (4 months ago)	(mod_security) mod_security (id:211700) triggered by 185.195.233.242 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:211700) triggered by 185.195.233.242 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 20:33:25.121722 2026] [security2:error] [pid 14923:tid 14923] [client 185.195.233.242:26944] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:[ ()]case ?\\\\(\|\\\\) ?like ?\\\\(\|\\\\bhaving ?[^\\\\s]+ ?[^\\\\w ]\|\\\\bif ?\\\\([\\\\d\\\\w] ?[=<>~])" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "33"] [id "211700"] [rev "8"] [msg "COMODO WAF: Detects conditional SQL injection attempts\|\|www.kountz.org\|F\|2"] [data "Matched Data: having found within MATCHED_VAR: 50AND1GROUPBYCONCAT(0x42316755,(SELECT(ELT(2836=2836,1))),0x73363869,FLOOR(RAND(0)2))HAVINGMIN(0)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.kountz.org"] [uri "/showrepo.php"] [unique_id "ae6u1VSLp_-SK9k13xCdzQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2026-04-20 19:12:20 (4 months ago)	ddos	DDoS Attack

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 147.185.133.152

🇫🇷 143.244.56.54

🇨🇳 120.48.33.69

🇺🇸 45.33.109.17

🇺🇸 216.73.216.242

🇳🇱 195.178.110.30

🇺🇸 162.216.150.108

🇮🇳 152.57.178.55

🇩🇪 152.53.21.84

🇺🇸 134.195.105.174

🇧🇷 200.189.23.1

🇹🇼 198.235.24.107

🇺🇸 91.230.168.125

🇫🇷 91.196.152.2

🇺🇸 44.200.179.192

🇸🇬 43.119.100.97

🇬🇧 35.203.210.13

🇨🇦 4.204.200.136

🇰🇷 222.239.251.12

🇰🇷 221.140.57.201