JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 107.174.52.85

107.174.52.85 was found in our database!

This IP was reported 156 times. Confidence of Abuse is 18%: ?

18%

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	107-174-52-85-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 107.174.52.85

Whois 107.174.52.85

IP Abuse Reports for 107.174.52.85:

This IP address has been reported a total of 156 times from 112 distinct sources. 107.174.52.85 was first reported on April 14th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-06-29 10:48:52 (1 week ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇮🇳 evicky2002	2026-06-29 04:52:15 (1 week ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 bogdanv	2026-06-28 08:18:25 (1 week ago)	$f2bV_matches	DDoS Attack Web Spam SQL Injection Brute-Force Bad Web Bot Web App Attack
🇧🇷 ICS Labs	2026-06-05 19:31:31 (1 month ago)	ICS Labs identified 107.174.52.85 as a malicious indicator from threat intelligence.	DDoS Attack Hacking Exploited Host
🇩🇪 bogdanv	2026-05-27 13:52:51 (1 month ago)	$f2bV_matches	DDoS Attack Web Spam SQL Injection Brute-Force Bad Web Bot Web App Attack
🇬🇧 sc user	2026-05-04 05:45:42 (2 months ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇬🇧 sc user	2026-04-30 17:41:22 (2 months ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇬🇧 sc user	2026-04-29 09:02:13 (2 months ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇭🇺 DumaNet	2026-04-28 18:37:00 (2 months ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Apr 28. 02:56:42 Source IP: 107.17 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Apr 28. 02:56:42 Source IP: 107.174.52.85 Portion of the log(s): 107.174.52.85 - [28/Apr/2026:02:56:39 +0200] "GET /api/.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" 107.174.52.85 - [28/Apr/2026:02:56:39 +0200] "GET /config.env HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0" 107.174.52.85 - [28/Apr/2026:02:56:39 +0200] "GET /app/.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0" 107.174.52.85 - [28/Apr/2026:02:56:39 +0200] "GET /.aws/credentials HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" 107.174.52.85 - [28/Apr/2026:02:56:39 +0200] "GET /.env.local HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Wind show less	Web App Attack Hacking
Anonymous	2026-04-28 16:31:53 (2 months ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇨🇦 Martin Poderon	2026-04-28 12:06:00 (2 months ago)	There was an attempt to access the backend login but no Additional Backend Password parameter was se ... show more There was an attempt to access the backend login but no Additional Backend Password parameter was set. show less	Hacking
🇩🇪 DocNetzwerk	2026-04-28 11:23:11 (2 months ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 107.174.52.85 (US/Un ... show more (apache-useragents) Failed apache-useragents trigger with match [redacted] from 107.174.52.85 (US/United States/107-174-52-85-host.colocrossing.com) show less	Bad Web Bot
🇩🇪 LRob	2026-04-28 10:15:03 (2 months ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-28 08:25:18 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 107.174.52.85 (107-174-52-85-host.colocrossing. ... show more (mod_security) mod_security (id:210492) triggered by 107.174.52.85 (107-174-52-85-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 04:25:11.292294 2026] [security2:error] [pid 16452:tid 16452] [client 107.174.52.85:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mcbrude.com"] [uri "/.env"] [unique_id "afBu5wcnRLOPIjXnzmtYLQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-04-28 08:14:53 (2 months ago)	107.174.52.85 - - [28/Apr/2026:11:14:52 +0300] "GET /.env HTTP/1.1" 404 706 "-" "Mozilla/5.0 (Window ... show more 107.174.52.85 - - [28/Apr/2026:11:14:52 +0300] "GET /.env HTTP/1.1" 404 706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 156 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.152

🇨🇳 14.117.226.122

🇬🇧 2a06:4880:4000::56

🇰🇷 211.223.107.86

🇭🇰 199.45.154.141

🇲🇽 187.224.84.72

🇺🇸 172.202.117.221

🇨🇳 101.126.89.144

🇰🇷 1.214.42.172

🇧🇩 103.135.136.109

🇷🇴 92.118.39.77

🇳🇱 91.92.40.11

🇨🇦 85.217.149.59

🇨🇳 47.114.122.127

🇳🇱 45.156.87.50

🇵🇰 39.38.118.39

🇨🇳 223.215.115.28

🇺🇸 174.137.133.49

🇩🇪 69.5.169.214

🇺🇸 66.132.172.109