JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 205.147.22.6

205.147.22.6 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 41%: ?

41%

ISP	PV-SL-HOSTED-Mexico-City-Network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS208172
Domain Name	ip.me
Country	🇲🇽 Mexico
City	Mexico City, Mexico City

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 205.147.22.6

Whois 205.147.22.6

IP Abuse Reports for 205.147.22.6:

This IP address has been reported a total of 44 times from 25 distinct sources. 205.147.22.6 was first reported on December 22nd 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 URAN Publishing Service	2026-10-15 09:43:11 (1 week ago)	[15/Oct/2026:12:43:11 +0300] -- 205.147.22.6 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /wp-si ... show more [15/Oct/2026:12:43:11 +0300] -- 205.147.22.6 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /wp-sitemap.xml HTTP/1.1 show less	Bad Web Bot Web App Attack
🇩🇪 grassau.com	2026-10-15 06:36:40 (1 week ago)	(tribe-events-crawler) Failed tribe-events-crawler trigger from 205.147.22.6 (MX/Mexico/Mexico City/ ... show more (tribe-events-crawler) Failed tribe-events-crawler trigger from 205.147.22.6 (MX/Mexico/Mexico City/Mexico City/-) show less	Hacking
🇫🇷 Sklurk	2026-10-12 01:14:26 (1 week ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-10-05 14:47:37 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 10:47:33.582898 2026] [security2:error] [pid 6499:tid 6499] [client 205.147.22.6:52930] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|trafficstopper.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "trafficstopper.com"] [uri "/"] [unique_id "asO4hd1oXJr7BQC-Kp2-ewAAAAI"], referer: https://localcitationbuilding.site/dir/quality-link-building-216609 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-03 07:32:59 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 03:32:53.826286 2026] [security2:error] [pid 28714:tid 28714] [client 205.147.22.6:51213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|gdhlgroup.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gdhlgroup.com"] [uri "/"] [unique_id "asCvpfmIeAECdbF-qra1fAAAAAg"], referer: https://backlinkstomysite.space/dir/trusted-domain-backlinks-79771 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-01 16:38:57 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 01 12:38:53.153392 2026] [security2:error] [pid 22792:tid 22792] [client 205.147.22.6:36706] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|scruffware.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "scruffware.com"] [uri "/"] [unique_id "ar6MnZkZWAft9aTTcQs4UAAAAAQ"], referer: https://naturallink.website/dir/seo-visibility-links-184378 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-30 05:16:47 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 01:16:43.242323 2026] [security2:error] [pid 22854:tid 22854] [client 205.147.22.6:33091] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.achildsspace2.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.achildsspace2.com"] [uri "/"] [unique_id "arybO4Pr7OKY-hMpKcHTCgAAAAc"], referer: https://backlinksonline.website/dir/natural-link-building-services-1591 show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-28 21:39:42 (3 weeks ago)	Shop search flood (L7 DDoS) \| path: /42-meilleur-velo-electrique-plus-de-10000-euros \| query: q=Fami ... show more Shop search flood (L7 DDoS) \| path: /42-meilleur-velo-electrique-plus-de-10000-euros \| query: q=Famille-Wild-Fastlane \| src_port: 54475 show less	DDoS Attack Web App Attack
🇺🇸 TPI-Abuse	2026-09-26 07:25:46 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 03:25:40.428677 2026] [security2:error] [pid 1334:tid 1334] [client 205.147.22.6:19447] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|backtosleep.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "backtosleep.com"] [uri "/"] [unique_id "ardzdNpK611RxMxSrYQ3QQAAAAA"], referer: https://creaseyfamilya.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-17 15:47:48 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-17 13:35:46 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210350) triggered by 205.147.22.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 09:35:40.491382 2026] [security2:error] [pid 19440:tid 19440] [client 205.147.22.6:14100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|appsdips.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "appsdips.com"] [uri "/apps/getmypov/403.shtml"] [unique_id "aqvsrCI0WaIbJWj3gYljVwAAAAs"], referer: https://findwebsitebacklinks.shop/dir/ranking-boost-backlinks-81037 show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-17 04:18:36 (1 month ago)	WEB attack	Brute-Force
Anonymous	2026-09-12 17:11:16 (1 month ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇩🇪 phil2k	2026-09-04 20:45:28 (1 month ago)	fail2ban:firewall:2026-09-04T22:45:25.370306+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> ... show more fail2ban:firewall:2026-09-04T22:45:25.370306+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=205.147.22.6 DST=<PRIVATE_IPv4> LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=33802 DF PROTO=TCP SPT=62816 DPT=23 WINDOW=65535 RES=0x00 SYN URGP=0 2026-09-04T22:45:25.370331+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=205.147.22.6 DST=<PRIVATE_IPv4> LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=6578 DF PROTO=TCP SPT=1368 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0 show less	DDoS Attack Port Scan Brute-Force SSH
🇺🇸 ipblock.com	2026-09-03 12:19:00 (1 month ago)	IPBlock protected site ID [4055-d][s=06]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 2804:14c:1af:8b93:c11f:b6f7:4ed1:9234

🇸🇬 212.73.148.41

🇭🇰 203.218.203.93

🇵🇦 200.46.176.186

🇺🇸 198.12.148.211

🇸🇬 168.144.139.226

🇨🇳 115.190.243.99

🇨🇳 106.38.205.224

🇳🇱 85.11.167.38

🇺🇸 45.45.237.39

🇧🇪 34.14.99.143

🇺🇦 31.43.61.128

🇺🇸 136.107.164.231

🇮🇳 103.123.53.88

🇫🇷 91.231.89.227

🇰🇷 52.141.2.20

🇳🇱 51.158.205.203

🇹🇼 35.221.138.107

🇺🇸 20.29.44.58

🇨🇳 14.103.117.85