AbuseIPDB » 185.197.249.223
185.197.249.223
This IP was reported 7 times. Confidence of
Abuse
is 38% : ?
ISP
Contabo GmbH
Usage Type
Data Center/Web Hosting/Transit
ASN
AS51167
Hostname(s)
vmi3385304.contaboserver.net
Domain Name
contabo.com
Country
🇫🇷
France
City
Lauterbourg, Grand Est
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 185.197.249.223 :
This IP address has been reported a total of
7
times from
6 distinct
sources.
185.197.249.223 was first reported on
June 21st 2026 , and the most recent report was
23 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
2026-06-22 14:06:35
(23 hours ago)
fail2ban apache-modsecurity web [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [uri "/"]
Web App Attack
🇫🇷
masterguru
2026-06-21 23:16:22
(1 day ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 185.197.249.223 (DE/Germany/vmi338530 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 185.197.249.223 (DE/Germany/vmi3385304.contaboserver.net): 1 in the last 3600 secs (0-195)
show less
Hacking
🇬🇷
setupgr
2026-06-21 22:53:12
(1 day ago)
(mod_security) mod_security (id:11000011) triggered by 185.197.249.223 (DE/Germany/Hamburg/Hamburg/- ...
show more
(mod_security) mod_security (id:11000011) triggered by 185.197.249.223 (DE/Germany/Hamburg/Hamburg/-/[AS51167 CONTABO]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Jun 22 01:53:10.049878 2026] [security2:error] [pid 1258419:tid 1258531] [client 185.197.249.223:55216] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "contaboserver.net" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "131"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: vmi3385304.contaboserver.net"] [severity "CRITICAL"] [hostname "www.adoro.gr"] [uri "/"] [unique_id "ajhrVmS6uqGD_es3_d2WpAAAAMM"]
show less
Port Scan
🇫🇷
masterguru
2026-06-21 03:05:20
(2 days ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 185.197.249.223 (DE/Germany/vmi338530 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 185.197.249.223 (DE/Germany/vmi3385304.contaboserver.net): 2 in the last 3600 secs (0-196)
show less
Hacking
🇺🇸
kosada.com
2026-06-21 02:51:37
(2 days ago)
Web vulnerability probing: /favicon.ico (bogus vhost/SNI)
Web App Attack
🇷🇺
DZBOT
2026-06-21 02:25:43
(2 days ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇪🇸
pipeline.es
2026-06-21 00:41:42
(2 days ago)
Port scanning / recon | Evidence: date=2026-06-21 time=02:41:12 devname="[redacted]" devid="[redacte ...
show more
Port scanning / recon | Evidence: date=2026-06-21 time=02:41:12 devname="[redacted]" devid="[redacted]" eventtime=1782002471669972269 tz=\"+0200\" logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd="[redacted]" srcip=185.197.249.223 srcport=33632 srcintf="[redacted]" srcintfrole=\"wan\" dstip=[redacted] dstport=443 dstintf="[redacted]" dstintfrole=\"lan\" srccountry=\"France\" dstcountry=\"Spain\" sessio | ASN: Contabo GmbH | Country: FR
show less
Port Scan
Web App Attack
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: