JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 4.225.166.222

4.225.166.222 was found in our database!

This IP was reported 118 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇸🇪 Sweden
City	Gavle, Gavleborg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 4.225.166.222

Whois 4.225.166.222

IP Abuse Reports for 4.225.166.222:

This IP address has been reported a total of 118 times from 104 distinct sources. 4.225.166.222 was first reported on July 29th 2026, and the most recent report was 34 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 todix	2026-07-29 13:35:25 (34 seconds ago)	Web App Attack Exploid from 4.225.166.222	Web App Attack
🇩🇪 zumbo.net	2026-07-29 13:32:10 (3 minutes ago)	[Wed Jul 29 16:32:09.594061 2026] [proxy_fcgi:error] [pid 2600387:tid 2600430] [client 4.225.166.222 ... show more [Wed Jul 29 16:32:09.594061 2026] [proxy_fcgi:error] [pid 2600387:tid 2600430] [client 4.225.166.222:0] AH01071: Got error 'Primary script unknown' [Wed Jul 29 16:32:09.626110 2026] [proxy_fcgi:error] [pid 2600387:tid 2600407] [client 4.225.166.222:0] AH01071: Got error 'Primary script unknown' [Wed Jul 29 16:32:09.683586 2026] [proxy_fcgi:error] [pid 2600387:tid 2600419] [client 4.225.166.222:0] AH01071: Got error 'Primary script unknown' [Wed Jul 29 16:32:09.715841 2026] [proxy_fcgi:error] [pid 2600387:tid 2600412] [client 4.225.166.222:0] AH01071: Got error 'Primary script unknown' [Wed Jul 29 16:32:09.766234 2026] [proxy_fcgi:error] [pid 2600388:tid 2600416] [client 4.225.166.222:0] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
🇮🇩 soc-yk	2026-07-29 13:30:15 (5 minutes ago)	Type: web_scanning Risk: 100 Events: 162 Evidence: - Automated hostile web probing detected - Repea ... show more Type: web_scanning Risk: 100 Events: 162 Evidence: - Automated hostile web probing detected - Repeated web scanning activity observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Web App Attack
🇫🇷 bazter.pro	2026-07-29 13:26:42 (9 minutes ago)	Fail2Ban: plesk-bot-aggressive - 15 failures	Port Scan Bad Web Bot Web App Attack
🇺🇸 lavnet.net	2026-07-29 13:23:32 (12 minutes ago)	4.225.166.222 - - [29/Jul/2026:13:23:31 +0000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 6074 ... show more 4.225.166.222 - - [29/Jul/2026:13:23:31 +0000] "GET /wp-admin/network/plugins.php HTTP/1.1" 404 6074 "-" "-" 4.225.166.222 - - [29/Jul/2026:13:23:31 +0000] "GET /aaa.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:13:23:31 +0000] "GET /aaa.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:13:23:32 +0000] "GET /gecko.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:13:23:32 +0000] "GET /gecko.php HTTP/1.1" 404 2050 "-" "-" ... show less	Brute-Force
🇩🇪 Ba-Yu	2026-07-29 13:21:56 (14 minutes ago)	WordPress hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
Anonymous	2026-07-29 13:11:20 (24 minutes ago)	Aggressive Robot or Attack DDOS	DDoS Attack
🇫🇷 masterguru	2026-07-29 13:11:13 (24 minutes ago)	Too much 404 requests in 1 hour. Operator GE matched 50 at IP:block_script. (4002-135)	Hacking Web App Attack
🇺🇸 WellSpring	2026-07-29 13:04:18 (31 minutes ago)	wordpress scan on wellspr.ing/wp-admin/css/colors/coffee/wp-adochan.php — WellSpr.ing/NetSentinel ci ... show more wordpress scan on wellspr.ing/wp-admin/css/colors/coffee/wp-adochan.php — WellSpr.ing/NetSentinel civic-AI security layer show less	Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-07-29 13:03:36 (32 minutes ago)	(aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 4.225.166.222 (SE/Sweden/-): 1 in the last 36 ... show more (aggressive_scanner) REGOLA 9 - Aggressive Web Scanner 4.225.166.222 (SE/Sweden/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 4.225.166.222 - - [29/Jul/2026:15:03:30 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 301 320 "-" "-" "-" host=colleflorido.it show less	Port Scan
🇺🇸 lavnet.net	2026-07-29 12:53:23 (42 minutes ago)	4.225.166.222 - - [29/Jul/2026:12:53:22 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.ph ... show more 4.225.166.222 - - [29/Jul/2026:12:53:22 +0000] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 6074 "-" "-" 4.225.166.222 - - [29/Jul/2026:12:53:22 +0000] "GET /this_is_a_new_hello_world.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:12:53:22 +0000] "GET /x.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:12:53:23 +0000] "GET /mgrr.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:12:53:23 +0000] "GET /001.php HTTP/1.1" 404 2050 "-" "-" 4.225.166.222 - - [29/Jul/2026:12:53:23 +0000] "GET /yup.php HTTP/1.1" 404 2050 "-" "-" ... show less	Brute-Force
🇩🇪 dbmwebdesign	2026-07-29 12:40:08 (55 minutes ago)	Repeated probing for non-existent PHP exploit paths blocked by Fail2Ban	Web App Attack
🇫🇷 Zundapper	2026-07-29 12:31:45 (1 hour ago)	4.225.166.222 - - [29/Jul/2026:14:31:42 +0200] "GET /wp-includes/sodium_compat/ HTTP/1.1" 404 146 "- ... show more 4.225.166.222 - - [29/Jul/2026:14:31:42 +0200] "GET /wp-includes/sodium_compat/ HTTP/1.1" 404 146 "-" "-" 4.225.166.222 - - [29/Jul/2026:14:31:42 +0200] "GET /wp-includes/Text/ HTTP/1.1" 404 146 "-" "-" 4.225.166.222 - - [29/Jul/2026:14:31:42 +0200] "GET /wp-content/uploads/ HTTP/1.1" 404 146 "-" "-" 4.225.166.222 - - [29/Jul/2026:14:31:44 +0200] "GET /wp-includes/blocks/post-comments-form/ HTTP/1.1" 404 146 "-" "-" 4.225.166.222 - - [29/Jul/2026:14:31:44 +0200] "GET /wp-admin/js/ HTTP/1.1" 404 146 "-" "-" ... show less	Web App Attack Port Scan
🇺🇸 MPL	2026-07-29 12:30:09 (1 hour ago)	tcp/80 (5 or more attempts)	Port Scan
🇸🇪 vaia.cloud	2026-07-29 12:30:01 (1 hour ago)	crowdsecurity/http-backdoors-attempts	Brute-Force Web App Attack

Showing 1 to 15 of 118 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 188.240.59.62

🇹🇭 165.154.232.165

🇳🇱 45.148.10.240

🇹🇼 35.229.189.114

🇺🇸 138.68.237.0

🇺🇸 134.209.68.82

🇨🇳 123.14.125.42

🇺🇸 74.125.186.157

🇺🇸 71.90.30.53

🇺🇸 66.132.172.148

🇺🇸 66.132.172.117

🇺🇸 66.132.172.41

🇨🇳 14.20.77.129

🇺🇸 4.236.187.78

🇺🇸 2607:f8b0:4001:c6a::120

🇮🇳 2405:201:c009:51a3:1cf6:13e3:7479:fa46

🇨🇳 183.6.64.180

🇨🇳 180.184.38.93

🇩🇪 172.238.126.119

🇨🇳 111.25.118.128