JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.252.223.25

185.252.223.25 was found in our database!

This IP was reported 66 times. Confidence of Abuse is 33%: ?

33%

ISP	M247 LTD Budapest Infrastructure
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	m247.com
Country	🇭🇺 Hungary
City	Budapest, Budapest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.252.223.25

Whois 185.252.223.25

IP Abuse Reports for 185.252.223.25:

This IP address has been reported a total of 66 times from 35 distinct sources. 185.252.223.25 was first reported on September 26th 2024, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-07-31 01:06:18 (19 hours ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-29 20:19:38 (2 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
Anonymous	2026-07-29 07:00:00 (2 days ago)	Automated Apache web application probing in selected 24h window; attempts=21, unique_paths=1, error_ ... show more Automated Apache web application probing in selected 24h window; attempts=21, unique_paths=1, error_responses=10; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (2 days ago)	Apache probe; attempts=21; exact paths: /xmlrpc.php	Web App Attack
🇹🇷 neron	2026-07-28 20:19:38 (3 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-27 14:19:38 (4 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-07-25 23:31:06 (5 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇲🇹 Malta	2026-07-13 02:33:42 (2 weeks ago)	185.252.223.25 - - [13/Jul/2026:04:33:42 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ... show more 185.252.223.25 - - [13/Jul/2026:04:33:42 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-07-08 17:46:45 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.25 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 13:46:39.472860 2026] [security2:error] [pid 7218:tid 7218] [client 185.252.223.25:63967] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.25 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "ak6M_9bDxQqnOGU5tYIJzQAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2026-07-05 06:23:29 (3 weeks ago)	185.252.223.25 - - [05/Jul/2026:08:23:29 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; ... show more 185.252.223.25 - - [05/Jul/2026:08:23:29 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇲🇹 Malta	2026-06-30 06:55:22 (1 month ago)	185.252.223.25 - - [30/Jun/2026:08:55:21 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Linux; A ... show more 185.252.223.25 - - [30/Jun/2026:08:55:21 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Linux; Android 12; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Mobile Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-06-27 18:33:13 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.25 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.25 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 14:33:07.131377 2026] [security2:error] [pid 361:tid 361] [client 185.252.223.25:57945] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.25 (+1 hits since last alert)\|odysseydogasporlari.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "odysseydogasporlari.com"] [uri "/xmlrpc.php"] [unique_id "akAXY983bZ6VY6qfgjQIawAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-21 02:12:24 (1 month ago)	WordPress wp-login.php Brute Force Attack	Brute-Force Web App Attack
🇲🇹 Malta	2026-06-12 05:01:36 (1 month ago)	185.252.223.25 - - [12/Jun/2026:07:01:36 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ... show more 185.252.223.25 - - [12/Jun/2026:07:01:36 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇦🇺 MAGIC	2026-06-01 00:06:03 (1 month ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot

Showing 1 to 15 of 66 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 5.135.229.99

🇺🇸 195.184.76.247

🇮🇩 157.10.182.14

🇺🇸 151.240.54.70

🇨🇳 106.12.144.153

🇺🇸 64.236.135.131

🇺🇸 34.229.166.45

🇺🇸 183.81.168.186

🇺🇸 172.253.213.24

🇺🇸 147.185.132.246

🇨🇳 113.95.140.116

🇹🇷 94.154.43.118

🇸🇪 82.117.126.160

🇷🇴 2.57.121.112

🇮🇶 212.237.121.213

🇰🇷 211.51.132.104

🇧🇪 198.235.24.215

🇳🇱 185.242.226.60

🇵🇱 176.53.159.197

🇺🇸 172.238.188.122