JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.252.223.7

185.252.223.7 was found in our database!

This IP was reported 73 times. Confidence of Abuse is 37%: ?

37%

ISP	M247 LTD Budapest Infrastructure
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	m247.com
Country	🇭🇺 Hungary
City	Budapest, Budapest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.252.223.7

Whois 185.252.223.7

IP Abuse Reports for 185.252.223.7:

This IP address has been reported a total of 73 times from 38 distinct sources. 185.252.223.7 was first reported on October 3rd 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-07-31 01:06:18 (1 day ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-29 20:19:38 (3 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
Anonymous	2026-07-29 07:00:00 (3 days ago)	Apache probe; attempts=17; exact paths: /xmlrpc.php	Web App Attack
🇹🇷 neron	2026-07-28 20:19:38 (4 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-24 15:30:03 (1 week ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇮🇹 VHosting	2026-07-24 14:10:06 (1 week ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 13:11:00 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.7 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 09:10:53.833821 2026] [security2:error] [pid 30645:tid 30645] [client 185.252.223.7:51861] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.7 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "alop3Wjixzp5VT8aPhITmwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SUNDAY Technologies	2026-07-09 20:58:41 (3 weeks ago)	... Jul 9 22:58:40 drop SRC=185.252.223.7 LEN=52 PROTO=TCP DPT=8080 ACK=0 WINDOW=65535 S ... show more ... Jul 9 22:58:40 drop SRC=185.252.223.7 LEN=52 PROTO=TCP DPT=8080 ACK=0 WINDOW=65535 SYN URGP=0 MARK=0x0 show less	Port Scan
Anonymous	2026-06-26 09:10:04 (1 month ago)	\| CMS scanner: 3 domains targeted (CMS (WordPress or Joomla) login attempt.)	Web App Attack Hacking SQL Injection
🇺🇸 TPI-Abuse	2026-06-21 16:14:29 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.7 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 12:14:26.005810 2026] [security2:error] [pid 24703:tid 24703] [client 185.252.223.7:52729] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.7 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "ajgN4vxxFI7DaoJ3JEZ8mAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-15 04:31:04 (1 month ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇲🇹 Malta	2026-06-14 15:46:16 (1 month ago)	185.252.223.7 - - [14/Jun/2026:17:46:16 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; C ... show more 185.252.223.7 - - [14/Jun/2026:17:46:16 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-06-04 07:47:46 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 185.252.223.7 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 185.252.223.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 03:47:41.651419 2026] [security2:error] [pid 15963:tid 15963] [client 185.252.223.7:59909] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.252.223.7 (+1 hits since last alert)\|thesalonx.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "thesalonx.com"] [uri "/xmlrpc.php"] [unique_id "aiEtnfqI54o7N4fvBRLC3gAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 noise.agency	2026-05-26 21:58:42 (2 months ago)	(wordpress) Failed wordpress login from 185.252.223.7 (HU/Hungary/-)	Brute-Force
🇲🇹 Malta	2026-05-22 04:34:47 (2 months ago)	185.252.223.7 - - [22/May/2026:06:34:47 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; C ... show more 185.252.223.7 - - [22/May/2026:06:34:47 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1" Brute-force password attempt show less	Hacking Web App Attack Brute-Force

Showing 1 to 15 of 73 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 110.53.0.118

🇷🇺 2a0f:d002:733d:f81d:faf0:82ff:fe7d:2322

🇺🇸 188.221.252.51

🇹🇭 110.164.193.196

🇹🇭 110.164.193.195

🇹🇭 110.49.76.244

🇺🇸 107.150.109.96

🇺🇸 67.227.1.6

🇺🇦 46.201.247.21

🇺🇸 34.133.253.180

🇩🇪 20.52.125.110

🇦🇺 220.240.180.41

🇺🇸 198.20.185.173

🇦🇱 192.109.220.3

🇺🇸 136.119.239.90

🇹🇼 128.14.236.41

🇮🇷 109.162.249.57

🇩🇪 109.91.4.177

🇲🇦 105.69.141.127

🇭🇰 101.36.113.134