JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 217.252.47.30

217.252.47.30 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 83%: ?

83%

ISP	Deutsche Telekom AG
Usage Type	Fixed Line ISP
ASN	AS3320
Hostname(s)	pd9fc2f1e.dip0.t-ipconnect.de
Domain Name	telekom.de
Country	🇩🇪 Germany
City	Stadthagen, Lower Saxony

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 217.252.47.30

Whois 217.252.47.30

IP Abuse Reports for 217.252.47.30:

This IP address has been reported a total of 15 times from 14 distinct sources. 217.252.47.30 was first reported on September 19th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 RAP	2026-09-21 15:32:12 (2 days ago)	2026-09-21 15:32:12 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
Anonymous	2026-09-21 10:23:34 (2 days ago)	Apache HTTP Server Directory Traversal.	Web App Attack
🇮🇳 Parth Maniar	2026-09-21 08:43:57 (2 days ago)	This IP address carried out 24 port scanning attempts on 20-09-2026. For more information or to repo ... show more This IP address carried out 24 port scanning attempts on 20-09-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Port Scan SSH
Anonymous	2026-09-21 05:44:30 (2 days ago)	217.252.47.30 - - [21/Sep/2026:07:44:29 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2 ... show more 217.252.47.30 - - [21/Sep/2026:07:44:29 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 150 "-" "-" ... show less	Brute-Force Web App Attack
🇮🇳 Parth Maniar	2026-09-21 05:35:45 (2 days ago)	This IP address carried out 6 SSH credential attack (attempts) on 20-09-2026. For more information o ... show more This IP address carried out 6 SSH credential attack (attempts) on 20-09-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Brute-Force SSH
🇮🇪 AutosOnShow	2026-09-21 04:29:05 (2 days ago)	blocked for webapp attack \| path requested: / \| seen at 2026-09-21 04:28:53.316 \|	Web App Attack
🇮🇹 www.tana.it	2026-09-21 00:36:04 (2 days ago)	PHP scan	Web App Attack
🇺🇸 TPI-Abuse	2026-09-20 12:41:57 (3 days ago)	(mod_security) mod_security (id:218420) triggered by 217.252.47.30 (pd9fc2f1e.dip0.t-ipconnect.de): ... show more (mod_security) mod_security (id:218420) triggered by 217.252.47.30 (pd9fc2f1e.dip0.t-ipconnect.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 08:41:52.306586 2026] [security2:error] [pid 3097:tid 3097] [client 217.252.47.30:38092] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.167:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.167"] [uri "/hello.world"] [unique_id "aq_UkGcgWbjjn0h7IXGTIwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-09-20 11:48:17 (3 days ago)	tcp/22 (2 or more attempts)	Port Scan
🇩🇪 netclix.gr	2026-09-20 07:43:07 (3 days ago)	(c5_web_scan) Custom5 Aggressive Web Scan 217.252.47.30 (DE/Germany/pd9fc2f1e.dip0.t-ipconnect.de): ... show more (c5_web_scan) Custom5 Aggressive Web Scan 217.252.47.30 (DE/Germany/pd9fc2f1e.dip0.t-ipconnect.de): 3 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: default:80 217.252.47.30 - - [20/Sep/2026:10:42:43 +0300] "POST /index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 403 405 "-" "libredtail-http" default:80 217.252.47.30 - - [20/Sep/2026:10:42:54 +0300] "POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1" 403 405 "-" "libredtail-http" default:80 217.252.47.30 - - [20/Sep/2026:10:43:00 +0300] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 402 "-" "libredtail-http" show less	Port Scan
Anonymous	2026-09-20 02:19:12 (3 days ago)	2026-09-20T04:16:23.055584+02:00 v1736525760 sshd-session[681864]: Invalid user admin from 217.252.4 ... show more 2026-09-20T04:16:23.055584+02:00 v1736525760 sshd-session[681864]: Invalid user admin from 217.252.47.30 port 42154 2026-09-20T04:17:18.788086+02:00 v1736525760 sshd-session[681920]: Invalid user user from 217.252.47.30 port 49822 2026-09-20T04:19:12.664179+02:00 v1736525760 sshd-session[682027]: Invalid user user from 217.252.47.30 port 36622 ... show less	Brute-Force SSH
🇨🇦 SecondBanana	2026-09-19 23:22:21 (3 days ago)	...	Brute-Force SSH
🇺🇸 xmission.com	2026-09-19 21:33:41 (3 days ago)	Blocked by UFW (TCP on 22) Source port: 33059 TTL: 53 Packet length: 44 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 22) Source port: 33059 TTL: 53 Packet length: 44 TOS: 0x00 This report (for 217.252.47.30) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan SSH Brute-Force
🇩🇪 MiniWest 😘	2026-09-19 20:40:50 (3 days ago)	Fail2Ban on ns1.fish-ns.de, Service - sshd: 3 failures from 217.252.47.30 in 3600 seconds	Brute-Force SSH
Anonymous	2026-09-19 20:40:12 (3 days ago)	denied traffic to a honeypot network. destination port 2222.	Port Scan Hacking

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 109.160.32.43

🇺🇸 74.249.196.100

🇱🇹 62.60.130.242

🇯🇵 34.104.137.243

🇰🇷 220.118.190.204

🇺🇸 198.74.58.192

🇷🇺 193.169.25.168

🇺🇸 144.172.109.237

🇫🇷 141.253.103.247

🇺🇸 195.184.76.191

🇰🇷 175.198.18.3

🇺🇸 172.69.6.16

🇵🇭 154.18.197.29

🇺🇸 129.121.139.111

🇹🇷 94.235.196.73

🇺🇦 91.225.88.57

🇺🇸 40.77.167.51

🇹🇼 35.201.159.73

🇺🇸 2600:1901:1:292::

🇺🇸 191.96.196.91