JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.204.1.224

185.204.1.224 was found in our database!

This IP was reported 292 times. Confidence of Abuse is 71%: ?

71%

ISP	Creanova
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51765
Hostname(s)	host-185-204-1-224.creanova.org
Domain Name	creanova.org
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.204.1.224

Whois 185.204.1.224

IP Abuse Reports for 185.204.1.224:

This IP address has been reported a total of 292 times from 131 distinct sources. 185.204.1.224 was first reported on February 6th 2021, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 sockominfo	2026-09-17 11:00:28 (6 hours ago)	Reported by TangerangKota-CSIRT. Status: MALICIOUS	Hacking Email Spam
🇮🇩 sockominfo	2026-09-17 10:00:08 (7 hours ago)	Active Response: IP 185.204.1.224 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Rep ... show more Active Response: IP 185.204.1.224 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇭🇷 bubausluge	2026-09-17 08:22:17 (9 hours ago)	Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 8 attempts, Period: 2026-09-17 08:01: ... show more Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 8 attempts, Period: 2026-09-17 08:01:15 to 2026-09-17 08:01:15 show less	Web App Attack Bad Web Bot
🇺🇸 kadour	2026-09-17 08:07:54 (9 hours ago)	[Thu Sep 17 03:07:52.230903 2026] [proxy_fcgi:error] [pid 2586:tid 2724] [client 185.204.1.224:37104 ... show more [Thu Sep 17 03:07:52.230903 2026] [proxy_fcgi:error] [pid 2586:tid 2724] [client 185.204.1.224:37104] AH01071: Got error 'Primary script unknown' [Thu Sep 17 03:07:52.231658 2026] [proxy_fcgi:error] [pid 101170:tid 101209] [client 185.204.1.224:37126] AH01071: Got error 'Primary script unknown' [Thu Sep 17 03:07:52.233271 2026] [proxy_fcgi:error] [pid 101170:tid 101208] [client 185.204.1.224:37150] AH01071: Got error 'Primary script unknown' [Thu Sep 17 03:07:52.233997 2026] [proxy_fcgi:error] [pid 3640739:tid 3640781] [client 185.204.1.224:37134] AH01071: Got error 'Primary script unknown' [Thu Sep 17 03:07:52.234783 2026] [proxy_fcgi:error] [pid 101170:tid 101210] [client 185.204.1.224:37140] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇩🇪 ecs.ge	2026-09-17 07:14:46 (10 hours ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇯🇵 tttomomi	2026-09-17 07:08:22 (10 hours ago)	Repeated probing for credential and configuration files, and for known webshell and remote-code-exec ... show more Repeated probing for credential and configuration files, and for known webshell and remote-code-execution endpoints, on our web server. Every request was refused with a 4xx status; none returned content. Paths probed: /.git/HEAD, /.env, /.git/config. show less	Web App Attack
🇩🇪 mzaiser12	2026-09-17 05:15:09 (12 hours ago)	Web application probing: 15 requests to typical attack paths (/.git/HEAD, /.env.dev, /.env.local, /. ... show more Web application probing: 15 requests to typical attack paths (/.git/HEAD, /.env.dev, /.env.local, /.env.backup) within 5 min. Reported automatically by a SIEM; contact via abuse mailbox of the reporting network. show less	Bad Web Bot Web App Attack
🇫🇮 Alexandr Kulkov	2026-09-17 05:02:25 (12 hours ago)	185.204.1.224 - - [17/Sep/2026:05:02:24 +0000] "GET /administrator/phpinfo.php HTTP/2.0" 404 146 "-" ... show more 185.204.1.224 - - [17/Sep/2026:05:02:24 +0000] "GET /administrator/phpinfo.php HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" 185.204.1.224 - - [17/Sep/2026:05:02:25 +0000] "POST /admin HTTP/2.0" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 04:56:42 (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.204.1.224 (host-185-204-1-224.creanova.org) ... show more (mod_security) mod_security (id:210492) triggered by 185.204.1.224 (host-185-204-1-224.creanova.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 00:56:37.733200 2026] [security2:error] [pid 27926:tid 27926] [client 185.204.1.224:43414] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.112"] [uri "/.env"] [unique_id "aqtzBSllYnKqc8caxpuSCAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇭 MWA SOC	2026-09-17 04:28:41 (13 hours ago)		Hacking
🇧🇾 lns.bz	2026-09-17 03:10:33 (14 hours ago)	.env scanning [BY]	Web App Attack
🇺🇸 mw	2026-09-02 00:00:22 (2 weeks ago)	GET /..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd HTTP/1.1	Web App Attack
🇺🇸 webgobe	2026-08-22 15:48:01 (3 weeks ago)	wew-(rsform) : try to access forms...	Hacking
🇹🇷 neron	2026-08-18 09:00:44 (4 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-08-17 07:23:12 (1 month ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack

Showing 1 to 15 of 292 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇦 51.36.233.85

🇧🇷 189.125.111.177

🇰🇪 102.204.198.138

🇰🇷 52.141.2.20

🇨🇳 49.72.212.22

🇺🇸 45.156.129.142

🇲🇦 41.143.4.212

🇷🇴 2.57.122.168

🇮🇩 157.15.83.81

🇹🇷 78.183.48.14

🇷🇸 77.105.37.219

🇩🇪 43.165.7.135

🇹🇷 5.47.160.68

🇰🇿 212.154.234.9

🇧🇷 191.37.68.23

🇿🇦 168.206.81.16

🇹🇳 164.160.1.220

🇯🇵 153.213.39.61

🇺🇸 147.185.132.144

🇨🇳 113.200.216.246