JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 223.247.222.47

223.247.222.47 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 57%: ?

57%

ISP	CHINANET Anhui province network
Usage Type	Fixed Line ISP
ASN	AS140527
Domain Name	hf.ah.cn
Country	🇨🇳 China
City	Hefei, Anhui

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 223.247.222.47

Whois 223.247.222.47

IP Abuse Reports for 223.247.222.47:

This IP address has been reported a total of 41 times from 21 distinct sources. 223.247.222.47 was first reported on June 25th 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 CounterScrape	2026-07-06 00:06:07 (3 weeks ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-04 02:02:13 (3 weeks ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-03 01:03:40 (3 weeks ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-02 00:03:52 (3 weeks ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-01 00:02:48 (3 weeks ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇦 URAN Publishing Service	2026-06-30 23:54:44 (3 weeks ago)	223.247.222.47 - - [01/Jul/2026:02:54:43 +0300] "GET /wp-config.php.save HTTP/1.1" 404 3325 "-" "Moz ... show more 223.247.222.47 - - [01/Jul/2026:02:54:43 +0300] "GET /wp-config.php.save HTTP/1.1" 404 3325 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" ... show less	Web App Attack
🇳🇱 wlt-blocker	2026-06-30 23:30:52 (3 weeks ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 22:56:11 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 18:56:08.355676 2026] [security2:error] [pid 17889:tid 17889] [client 223.247.222.47:42795] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cocinasintegralesjp.com.spyasociados.com"] [uri "/.env"] [unique_id "akRJiDDptOZE3S9EDNUmngAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 22:29:56 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 18:29:49.363847 2026] [security2:error] [pid 14883:tid 14883] [client 223.247.222.47:58179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.saveourstats.com"] [uri "/.env.test"] [unique_id "akRDXaTZiCQhUwLErOQu0QAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-30 22:03:23 (3 weeks ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-06-30 22:02:24 (3 weeks ago)	Http Port:80 (http_status:404) - Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ... show more Http Port:80 (http_status:404) - Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran) show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 22:00:06 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 17:59:57.567608 2026] [security2:error] [pid 4094:tid 4094] [client 223.247.222.47:48073] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bickleton.org"] [uri "/.env"] [unique_id "akQ8XYhlrdtwXUpNUOgfIQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Viveronese	2026-06-30 21:50:19 (3 weeks ago)	HTTP vulnerability scanning	Web App Attack
🇫🇷 dynamix	2026-06-30 21:27:41 (3 weeks ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 21:14:15 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.247.222.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 17:14:07.129588 2026] [security2:error] [pid 14964:tid 14964] [client 223.247.222.47:41810] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "austintrauma.com"] [uri "/.env"] [unique_id "akQxnzW9zrQn9HxBRqOXRgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 23.29.118.224

🇺🇸 216.226.77.30

🇰🇷 211.105.129.57

🇰🇪 196.207.155.235

🇺🇸 143.110.200.119

🇧🇯 137.255.13.44

🇺🇸 91.230.168.125

🇱🇹 77.90.185.20

🇮🇱 5.29.34.98

🇨🇳 180.76.104.208

🇮🇳 122.170.111.140

🇻🇳 113.176.143.168

🇮🇩 103.129.150.86

🇹🇷 88.248.183.7

🇧🇬 79.124.59.78

🇺🇸 74.125.80.147

🇷🇺 31.173.0.140

🇺🇦 31.40.134.78

🇳🇱 217.60.195.187

🇧🇷 187.61.114.116