JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 5.253.204.204

5.253.204.204 was found in our database!

This IP was reported 189 times. Confidence of Abuse is 65%: ?

65%

ISP	M247 LTD Luxembourg Infrastructure
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	m247.com
Country	🇱🇺 Luxembourg
City	Luxembourg, Luxembourg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 5.253.204.204

Whois 5.253.204.204

IP Abuse Reports for 5.253.204.204:

This IP address has been reported a total of 189 times from 57 distinct sources. 5.253.204.204 was first reported on March 9th 2025, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇪 vaia.cloud	2026-08-21 23:10:02 (6 hours ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
🇳🇱 e.fierstra	2026-08-20 22:12:11 (1 day ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-08-20 21:59:13 (1 day ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-19. show less	Web App Attack SSH Hacking
🇵🇱 Budyn	2026-08-20 18:29:41 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.website \| URI: /vendor/phpunit/src/Util/PHP/eval-stdin.php \| UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 \| BODY: <?php echo(md5("Hello")); show less	Hacking Web App Attack
🇺🇸 xmission.com	2026-08-20 01:35:58 (2 days ago)	Blocked by UFW (TCP on 1) Source port: 6342 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 5. ... show more Blocked by UFW (TCP on 1) Source port: 6342 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 5.253.204.204) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇵🇱 Budyn	2026-08-19 07:45:53 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: shop.astropot.space \| URI: /admin/.env \| UA: Mozilla/5.0 (Linux; Android 10; SM-G970F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 OPR/76.2.4027.73374 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇺🇸 xmission.com	2026-08-19 06:30:58 (2 days ago)	Blocked by UFW (TCP on 1) Source port: 2431 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 5. ... show more Blocked by UFW (TCP on 1) Source port: 2431 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 5.253.204.204) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇵🇱 Budyn	2026-08-18 21:16:46 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: nexus.definitelynotahoneypot.xyz \| URI: /admin/.env \| UA: Mozilla/5.0 (Android 14; Mobile; rv:136.0) Gecko/136.0 Firefox/136. \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-08-18 16:15:26 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sweetpuddingtrap.top \| URI: /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input \| UA: Mozilla/5.0 (Windows Mobile 10; Android 10.0; Microsoft; Lumia 950XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Edge/40.15254.603 \| BODY: <?php echo(md5("Hello")); ?> show less	Hacking Web App Attack
🇫🇷 Octopuce	2026-08-18 05:47:23 (3 days ago)	Aggressive web search of vulnerable pages: /admin/.env /lib/phpunit/Util/PHP/eval-stdin.php /index.p ... show more Aggressive web search of vulnerable pages: /admin/.env /lib/phpunit/Util/PHP/eval-stdin.php /index.php /vendor/phpunit/phpunit/src/Util/PHP/eva ... show less	Web App Attack
🇺🇸 mw	2026-08-18 00:01:24 (4 days ago)	GET /cms/.env HTTP/1.1	Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 22:56:56 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 5.253.204.204 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 5.253.204.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 18:56:53.093903 2026] [security2:error] [pid 18104:tid 18104] [client 5.253.204.204:49721] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "advmach.com"] [uri "/backend/.env"] [unique_id "aoORtczb8bsuwFoMCOUT8QAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 11:48:32 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 5.253.204.204 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 5.253.204.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 07:48:26.431392 2026] [security2:error] [pid 15834:tid 15834] [client 5.253.204.204:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "globetechsecurities.com"] [uri "/.env.example"] [unique_id "aoL1CkAu2Z1AG7Xjc0s9NAAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 n2nguyenn2nguyen	2026-08-16 23:52:39 (5 days ago)	Blocked by YFC Security on https://parcl9.com — type: rapid_scan_attempts	Web App Attack
🇺🇸 xmission.com	2026-08-16 06:06:58 (5 days ago)	Blocked by UFW (TCP on 1) Source port: 61027 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 5 ... show more Blocked by UFW (TCP on 1) Source port: 61027 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 5.253.204.204) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 189 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 145.224.90.223

🇦🇷 138.118.213.68

🇨🇳 120.195.54.49

🇨🇳 106.13.107.71

🇷🇴 92.118.39.77

🇫🇷 85.217.140.29

🇩🇪 69.5.169.224

🇮🇩 36.89.252.58

🇨🇦 20.151.9.151

🇩🇪 213.209.159.142

🇲🇽 201.158.115.119

🇺🇸 195.184.76.187

🇺🇸 195.184.76.52

🇬🇧 118.193.65.234

🇫🇷 85.217.140.8

🇩🇪 47.254.134.254

🇺🇸 47.251.82.209

🇧🇷 45.181.215.88

🇳🇱 45.148.10.141

🇷🇺 37.9.68.165