JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 8.222.180.242

8.222.180.242 was found in our database!

This IP was reported 144 times. Confidence of Abuse is 33%: ?

33%

ISP	Alibaba Cloud (Singapore) Private Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS45102
Domain Name	alibabacloud.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 8.222.180.242

Whois 8.222.180.242

IP Abuse Reports for 8.222.180.242:

This IP address has been reported a total of 144 times from 106 distinct sources. 8.222.180.242 was first reported on May 31st 2023, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-16 14:46:56 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 10:46:50.842945 2026] [security2:error] [pid 1027:tid 1027] [client 8.222.180.242:42826] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "modelengines.info"] [uri "/.env"] [unique_id "alju2prorfrt5vdzJXyVwQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 13:23:19 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 09:23:10.477322 2026] [security2:error] [pid 2324:tid 2324] [client 8.222.180.242:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.org"] [uri "/.env.backup"] [unique_id "aljbPg5pnJIdmAfMeP3GkwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-07-16 13:08:53 (3 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇺🇸 daveoctober	2026-07-15 21:34:40 (3 days ago)	October Sentinel: honeypot triggered	Bad Web Bot Web App Attack
Anonymous	2026-07-15 20:05:06 (3 days ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇩🇪 big-cloud.nl	2026-07-15 17:21:52 (4 days ago)	Try to access /.git/config	Web App Attack
🇺🇸 TPI-Abuse	2025-11-07 00:54:40 (8 months ago)	(mod_security) mod_security (id:225170) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 06 19:54:33.483109 2025] [security2:error] [pid 25535:tid 25535] [client 8.222.180.242:51910] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|stalbansparish.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stalbansparish.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "aQ1DSYwOI9DtdYb5lvKhUQAAAA8"], referer: https://stalbansparish.org/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2025-11-06 21:01:59 (8 months ago)	postfix-non-smtp-command - IP: 8.222.180.242 - time="2025-11-06T22:01:58+01:00" level=info msg="(55 ... show more postfix-non-smtp-command - IP: 8.222.180.242 - time="2025-11-06T22:01:58+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-non-smtp-command by ip 8.222.180.242 (SG/45102) : 4h ban on Ip 8.222.180.242" show less	Email Spam
🇺🇸 TPI-Abuse	2025-10-08 22:30:56 (9 months ago)	(mod_security) mod_security (id:225170) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 8.222.180.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 08 18:30:50.406722 2025] [security2:error] [pid 16295:tid 16295] [client 8.222.180.242:45170] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jolankagroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aObmGkC6GuTT7Z4_1_2c1gAAABU"], referer: https://jolankagroup.com/wp-json/wp/v2/users/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 KIsmay	2023-06-03 20:19:50 (3 years ago)	SSH Brute Force	Brute-Force SSH
🇺🇸 WestonReed	2023-06-03 19:44:30 (3 years ago)	Jun 3 12:44:22 onion sshd[137765]: Invalid user ubnt from 8.222.180.242 port 35230 Jun 3 12:44:23 ... show more Jun 3 12:44:22 onion sshd[137765]: Invalid user ubnt from 8.222.180.242 port 35230 Jun 3 12:44:23 onion sshd[137767]: Invalid user ansible from 8.222.180.242 port 44304 Jun 3 12:44:27 onion sshd[137772]: Invalid user user from 8.222.180.242 port 34306 Jun 3 12:44:29 onion sshd[137776]: Invalid user pi from 8.222.180.242 port 35166 Jun 3 12:44:30 onion sshd[137778]: Invalid user admin from 8.222.180.242 port 43762 ... show less	Brute-Force SSH
🇺🇸 WhiteFireOCN1	2023-06-03 19:11:08 (3 years ago)	12 unauthorized connection attempts to port 22 TCP/22 - 8[.]222[.]180[.]242:54170 - 2023-06-03T19:09 ... show more 12 unauthorized connection attempts to port 22 TCP/22 - 8[.]222[.]180[.]242:54170 - 2023-06-03T19:09:29 TCP/22 - 8[.]222[.]180[.]242:54298 - 2023-06-03T19:09:36 TCP/22 - 8[.]222[.]180[.]242:50464 - 2023-06-03T19:09:48 TCP/22 - 8[.]222[.]180[.]242:54390 - 2023-06-03T19:09:57 TCP/22 - 8[.]222[.]180[.]242:53790 - 2023-06-03T19:10:09 TCP/22 - 8[.]222[.]180[.]242:33494 - 2023-06-03T19:10:32 TCP/22 - 8[.]222[.]180[.]242:50208 - 2023-06-03T19:10:50 TCP/22 - 8[.]222[.]180[.]242:58764 - 2023-06-03T19:11:13 show less	Port Scan Hacking Brute-Force
🇺🇸 RAP	2023-06-03 18:42:45 (3 years ago)	2023-06-03 18:42:45 UTC Unauthorized activity to TCP port 22. SSH	SSH
🇺🇸 PlusReed	2023-06-03 18:37:00 (3 years ago)	Jun 3 14:36:54 plusreed sshd[18876]: Invalid user admin from 8.222.180.242 port 42336 Jun 3 14:36: ... show more Jun 3 14:36:54 plusreed sshd[18876]: Invalid user admin from 8.222.180.242 port 42336 Jun 3 14:36:54 plusreed sshd[18876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.222.180.242 Jun 3 14:36:54 plusreed sshd[18876]: Invalid user admin from 8.222.180.242 port 42336 Jun 3 14:36:56 plusreed sshd[18876]: Failed password for invalid user admin from 8.222.180.242 port 42336 ssh2 Jun 3 14:36:58 plusreed sshd[18881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.222.180.242 user=root Jun 3 14:37:00 plusreed sshd[18881]: Failed password for root from 8.222.180.242 port 52874 ssh2 ... show less	Brute-Force SSH
🇳🇱 nikoladd	2023-06-03 15:59:33 (3 years ago)	Jun 3 18:59:04 server2 sshd\[16718\]: User root from 8.222.180.242 not allowed because not listed i ... show more Jun 3 18:59:04 server2 sshd\[16718\]: User root from 8.222.180.242 not allowed because not listed in AllowUsers Jun 3 18:59:13 server2 sshd\[16724\]: User root from 8.222.180.242 not allowed because not listed in AllowUsers Jun 3 18:59:22 server2 sshd\[16733\]: Invalid user ubnt from 8.222.180.242 Jun 3 18:59:24 server2 sshd\[16735\]: Invalid user test from 8.222.180.242 Jun 3 18:59:30 server2 sshd\[16737\]: Invalid user orangepi from 8.222.180.242 Jun 3 18:59:33 server2 sshd\[16741\]: Invalid user ansadmin from 8.222.180.242 show less	Brute-Force

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇱 109.236.45.25

🇳🇱 176.65.148.84

🇧🇪 109.68.161.68

🇷🇴 80.94.92.27

🇷🇴 2.57.122.245

🇺🇸 2a04:4e40:e020:0:f48:b706:7077:2568

🇨🇦 208.96.233.67

🇺🇸 205.210.31.89

🇷🇴 193.46.255.86

🇺🇸 185.238.231.121

🇺🇸 162.216.150.92

🇮🇳 150.241.244.100

🇩🇪 140.248.227.13

🇵🇭 124.6.178.98

🇹🇭 118.27.146.150

🇹🇬 102.64.164.186

🇩🇪 85.216.81.75

🇳🇱 45.148.10.240

🇺🇸 2001:4830:c200:5:9999::149

🇰🇷 221.159.21.170