JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.225.25.2

64.225.25.2 was found in our database!

This IP was reported 192 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Clifton, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.225.25.2

Whois 64.225.25.2

IP Abuse Reports for 64.225.25.2:

This IP address has been reported a total of 192 times from 125 distinct sources. 64.225.25.2 was first reported on January 11th 2024, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 strefapi_com	2026-09-16 05:58:50 (2 hours ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
Anonymous	2026-09-15 23:51:00 (8 hours ago)	ZUOBDE WEBEXPLOIT 64.225.25.2 (64.225.25.2)	Web App Attack
Anonymous	2026-09-15 23:37:02 (8 hours ago)	Bot / scanning and/or hacking attempts: GET /wp-config.php.save HTTP/1.1, GET /wp-config.php~ HTTP/1 ... show more Bot / scanning and/or hacking attempts: GET /wp-config.php.save HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /wp-config.php.bak HTTP/1.1 show less	Hacking Web App Attack
🇩🇪 BlueWire Hosting	2026-09-15 16:47:31 (15 hours ago)	Probing websites for vulnerabilities	Web App Attack
🇳🇱 Alt255	2026-09-15 14:37:47 (17 hours ago)	[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 64.225.25.2 - - [15/Sep/2026:16:37:32 +0200] "GET /wp-config.php.bak HTTP/1.1" 301 4365 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-09-15 14:24:04 (17 hours ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 64.225.25.2 (US/United States/-): 1 in t ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 64.225.25.2 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 64.225.25.2 - - [15/Sep/2026:16:24:02 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" "-" host=studioegizi.it show less	Port Scan
🇦🇺 2000cn.com.au	2026-09-15 12:19:43 (19 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-probing	Web App Attack Hacking
🇺🇸 VanKoh	2026-09-15 08:48:50 (23 hours ago)	64.225.25.2 - - [15/Sep/2026:02:48:01 -0600] "GET /wp-content/plugins/gemini/ HTTP/1.1" 301 162 "-" ... show more 64.225.25.2 - - [15/Sep/2026:02:48:01 -0600] "GET /wp-content/plugins/gemini/ HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:02:48:40 -0600] "GET /wp-content/plugins/groq/ HTTP/1.1" 301 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:02:48:49 -0600] "GET /wp-content/plugins/groq/ HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	DDoS Attack Web App Attack
🇺🇸 VanKoh	2026-09-15 08:25:31 (23 hours ago)	64.225.25.2 - - [15/Sep/2026:02:25:24 -0600] "GET /wp-config.php.old HTTP/1.1" 444 0 "-" "Mozilla/5. ... show more 64.225.25.2 - - [15/Sep/2026:02:25:24 -0600] "GET /wp-config.php.old HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:02:25:27 -0600] "GET /wp-config.php.orig HTTP/1.1" 301 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:02:25:30 -0600] "GET /wp-config.php.orig HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	DDoS Attack Web App Attack
Anonymous	2026-09-15 02:34:49 (1 day ago)	BIDSODE WEBEXPLOIT 64.225.25.2 (64.225.25.2)	Web App Attack
🇺🇸 TAY	2026-09-15 02:21:55 (1 day ago)	64.225.25.2 - - [15/Sep/2026:10:21:29 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 6146 "-" "Mozilla ... show more 64.225.25.2 - - [15/Sep/2026:10:21:29 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 6146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:10:21:32 +0800] "GET /wp-config.php.bak HTTP/1.1" 404 48454 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:10:21:34 +0800] "GET /wp-config.php~ HTTP/1.1" 301 6143 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:10:21:41 +0800] "GET /wp-config.php~ HTTP/1.1" 404 48454 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 64.225.25.2 - - [15/Sep/2026:10:21:43 +0800] "GET /wp-config.php.save HTTP/1.1" 301 6147 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom ... show less	Brute-Force
🇺🇸 TPI-Abuse	2026-09-15 01:38:17 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 64.225.25.2 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 64.225.25.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 21:38:11.829792 2026] [security2:error] [pid 24065:tid 24065] [client 64.225.25.2:48506] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prayers4america.com"] [uri "/wp-config.php.bak"] [unique_id "aqihg6JuobMpqejZ5kS4pQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 strefapi_com	2026-09-14 19:47:19 (1 day ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 Petros Stefanakis	2026-09-14 19:26:04 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 64.225.25.2 (US/United States/-)	SQL Injection
🇬🇧 thetomtaylor.co.uk	2026-09-14 17:57:02 (1 day ago)	Fail2Ban - [WAF]ModSecurity rule violation on modsecurity ... [wa01,wa02]	Hacking SQL Injection Web App Attack

Showing 1 to 15 of 192 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇦 188.51.204.127

🇦🇷 179.42.161.168

🇩🇪 164.92.247.156

🇬🇧 159.65.82.174

🇮🇷 91.251.27.183

🇺🇸 89.117.17.17

🇮🇹 83.224.181.107

🇳🇱 81.19.216.102

🇺🇸 34.134.51.213

🇰🇷 34.47.125.118

🇰🇿 31.132.90.3

🇸🇬 8.219.129.175

🇺🇦 188.191.20.172

🇩🇪 185.220.101.173

🇪🇨 170.254.28.244

🇨🇳 150.158.46.66

🇺🇸 66.132.224.235

🇨🇳 59.59.212.251

🇰🇷 59.8.48.41

🇲🇾 49.124.151.51