JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.25.23.66

185.25.23.66 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 37%: ?

37%

ISP	GREEK INTERNET SERVICES
Usage Type	Data Center/Web Hosting/Transit
ASN	AS209150
Hostname(s)	linux31.name-servers.gr
Domain Name	pointer.gr
Country	🇬🇷 Greece
City	Kilkis, Central Macedonia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.25.23.66

Whois 185.25.23.66

IP Abuse Reports for 185.25.23.66:

This IP address has been reported a total of 14 times from 10 distinct sources. 185.25.23.66 was first reported on December 26th 2023, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-01 10:19:07 (19 hours ago)	(mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:18:59.796519 2026] [security2:error] [pid 27772:tid 27772] [client 185.25.23.66:55848] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.carolinafootprints.rddeckerphotography.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.carolinafootprints.rddeckerphotography.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apamk3HfkCekvnWUjG-bFgAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 JimArchon72	2026-09-01 01:05:01 (1 day ago)	2026/09/01 01:02:27 "GET /wp-login.php HTTP/2.0"	Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 20:51:39 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 16:51:33.915902 2026] [security2:error] [pid 1784:tid 1809] [client 185.25.23.66:43286] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|inal.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "inal.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apXpVStPoq9KPMFVFCj6oAAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 19:39:17 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 15:39:09.568020 2026] [security2:error] [pid 18946:tid 18946] [client 185.25.23.66:59864] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.drbolen.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.drbolen.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apXYXSiM1AOz85lsOhRbQAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-08-30 22:31:22 (2 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇫🇷 masterguru	2026-08-30 17:25:25 (2 days ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 185.25.23.66 (GR/Greece/linux31.name-servers. ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 185.25.23.66 (GR/Greece/linux31.name-servers.gr): 1 in the last 3600 secs (0-196) show less	Hacking
🇺🇸 TPI-Abuse	2026-08-30 17:08:36 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 185.25.23.66 (linux31.name-servers.gr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 13:08:28.131816 2026] [security2:error] [pid 30194:tid 30194] [client 185.25.23.66:46316] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thehealthyplaceclayton.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thehealthyplaceclayton.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apRjjD0TalCe4pUpGXLG2gAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-08-30 01:20:00 (3 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇫🇷 www.unitiz.com	2024-03-04 11:56:36 (2 years ago)	Malicious Traffic/Form Submission	Phishing Web Spam
🇦🇺 oncord	2024-02-15 03:12:27 (2 years ago)	Form spam	Web Spam
🇺🇸 oncord	2024-02-06 06:17:37 (2 years ago)	Form spam	Web Spam
🇨🇭 unifr	2024-02-02 00:19:12 (2 years ago)	Unauthorized IMAP connection attempt	Brute-Force
Anonymous	2024-01-29 08:01:27 (2 years ago)	Abuse of signup form	Web Spam Web App Attack
🇺🇸 MortimerCat	2023-12-26 13:56:30 (2 years ago)	Attempting to exploit via a http POST	Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.188.168

🇳🇱 195.178.110.228

🇦🇺 193.116.77.27

🇳🇱 185.93.89.23

🇬🇧 163.5.138.22

🇮🇳 122.163.127.14

🇺🇸 95.181.237.13

🇺🇸 63.245.90.66

🇩🇪 45.141.116.84

🇸🇬 45.82.78.103

🇬🇧 35.203.210.101

🇺🇸 34.24.218.205

🇮🇹 2.196.142.46

🇺🇸 2001:470:1:fb5::175

🇹🇼 220.134.73.52

🇩🇪 213.209.159.3

🇺🇬 196.0.242.54

🇮🇩 165.154.48.160

🇬🇧 163.5.138.121

🇺🇸 159.89.225.170