JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.252.223.4

185.252.223.4 was found in our database!

This IP was reported 55 times. Confidence of Abuse is 33%: ?

33%

ISP	M247 LTD Budapest Infrastructure
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	m247.com
Country	🇭🇺 Hungary
City	Budapest, Budapest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.252.223.4

Whois 185.252.223.4

IP Abuse Reports for 185.252.223.4:

This IP address has been reported a total of 55 times from 31 distinct sources. 185.252.223.4 was first reported on July 3rd 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 alferez	2026-07-28 15:59:28 (2 days ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇮🇹 VHosting	2026-07-27 11:00:04 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 14:44:32 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.4 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 10:44:29.162616 2026] [security2:error] [pid 7847:tid 7847] [client 185.252.223.4:63205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.4 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "alZLTcGIQnE0n_ByOd7loAAAACQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2026-07-06 17:22:36 (3 weeks ago)	185.252.223.4 - - [06/Jul/2026:19:22:36 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; C ... show more 185.252.223.4 - - [06/Jul/2026:19:22:36 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
Anonymous	2026-06-30 19:20:04 (1 month ago)	\| CMS scanner: 3 domains targeted (CMS (WordPress or Joomla) login attempt.)	Web App Attack Hacking SQL Injection
🇦🇺 MAGIC	2026-06-16 02:02:18 (1 month ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇲🇹 Malta	2026-06-12 19:12:15 (1 month ago)	185.252.223.4 - - [12/Jun/2026:21:12:15 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh ... show more 185.252.223.4 - - [12/Jun/2026:21:12:15 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇫🇷 Yepngo	2026-06-09 08:20:18 (1 month ago)	185.252.223.4 - - [09/Jun/2026:10:20:18 +0200] "POST /wp-login.php HTTP/2.0" 200 12078 "-" "Mozilla/ ... show more 185.252.223.4 - - [09/Jun/2026:10:20:18 +0200] "POST /wp-login.php HTTP/2.0" 200 12078 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" 185.252.223.4 - - [09/Jun/2026:10:20:18 +0200] "POST /wp-login.php HTTP/2.0" 200 12078 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" ... show less	Brute-Force Web App Attack
🇮🇹 VHosting	2026-06-08 02:40:03 (1 month ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 integrantservices.com	2026-05-29 20:16:32 (2 months ago)	(wordpress) Failed wordpress login from 185.252.223.4 (HU/Hungary/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-05-28 12:21:08 (2 months ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.4 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 08:21:00.091446 2026] [security2:error] [pid 1857:tid 1857] [client 185.252.223.4:54001] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.4 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "ahgzLMXgKT3VlOPkV1yp2AAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2026-05-22 07:31:14 (2 months ago)	185.252.223.4 - - [22/May/2026:09:31:14 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows N ... show more 185.252.223.4 - - [22/May/2026:09:31:14 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇪🇸 masterguru	2026-05-16 21:53:35 (2 months ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (5001900-122)	Web App Attack
🇮🇹 VHosting	2026-05-07 05:35:03 (2 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇪🇸 masterguru	2026-04-23 07:21:56 (3 months ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (5001900-122)	Web App Attack

Showing 1 to 15 of 55 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a04:c300:1000::301

🇷🇴 193.46.255.154

🇺🇸 162.216.150.244

🇨🇱 136.248.247.188

🇨🇳 117.176.220.76

🇨🇳 116.140.211.29

🇨🇦 51.222.168.162

🇬🇧 51.195.244.139

🇮🇹 31.59.89.180

🇮🇷 185.116.161.214

🇮🇳 183.83.196.35

🇬🇧 154.16.44.54

🇨🇳 124.174.77.133

🇵🇭 124.83.9.140

🇨🇳 118.196.116.160

🇨🇳 116.179.32.238

🇰🇷 116.126.64.36

🇰🇷 116.125.223.73

🇹🇷 93.182.104.191

🇧🇷 45.238.2.74