JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.85.97.204

157.85.97.204 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 64%: ?

64%

ISP	ReadyIDC Co.,Ltd.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS56309
Domain Name	readyidc.com
Country	🇹🇭 Thailand
City	Bangkok, Bangkok

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.85.97.204

Whois 157.85.97.204

IP Abuse Reports for 157.85.97.204:

This IP address has been reported a total of 26 times from 17 distinct sources. 157.85.97.204 was first reported on August 11th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 edgeshield	2026-09-17 09:19:08 (3 days ago)	Automated web request flooding / DDoS (EdgeShield WAF).	DDoS Attack
🇪🇸 el-brujo	2026-09-16 18:44:38 (4 days ago)	HTTP DDoS Attack Layer 7 Botnet Dstat	DDoS Attack
🇺🇸 SiliSoftware	2026-09-12 03:54:53 (1 week ago)	/_ignition/health-check	Web App Attack
🇵🇱 MatStef132	2026-09-12 01:10:31 (1 week ago)	MatShield L7: blocked on test-clean.mathost.eu (ua-quarantined)	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-11 13:55:17 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 157.85.97.204 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 157.85.97.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 09:55:09.780929 2026] [security2:error] [pid 24278:tid 24278] [client 157.85.97.204:43500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ps-omega.com"] [uri "/.git/config"] [unique_id "aqQIPaqgo1C-6skAQLWjOAAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-10 05:53:28 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 157.85.97.204 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 157.85.97.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 10 01:53:18.796907 2026] [security2:error] [pid 9980:tid 9980] [client 157.85.97.204:57434] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jaragoodrich.com.arsenaultartistmanagement.com"] [uri "/.git/config"] [unique_id "aqJFzjXBM-R5cCXuO2mxyQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 island-freaks.com	2026-09-09 18:52:30 (1 week ago)	Attack Type: WordPress Exploit Bot attempt on /photo/113997/http:///url/ \| DNS 157.85.97.204 \| Agent ... show more Attack Type: WordPress Exploit Bot attempt on /photo/113997/http:///url/ \| DNS 157.85.97.204 \| Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 show less	Port Scan Hacking Bad Web Bot Exploited Host Web App Attack
🇵🇱 Budyn	2026-09-08 23:10:54 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: shop.astropot.site \| URI: /.aws/credentials \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-09-08 21:59:50 (1 week ago)	Auto-ban: >3000 req/min op 2026-09-08	Web App Attack SSH Hacking
🇵🇱 Budyn	2026-09-08 18:50:36 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cloud.goblinpot.online \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-09-04 02:35:03 (2 weeks ago)	Detected mail brute force attack from different servers	Brute-Force
🇮🇩 xveil	2026-08-31 18:27:48 (2 weeks ago)	2026-09-01T01:27:44.884689 mail-honeypot postfix/submission/smtpd[25487]: warning: unknown[157.85.97 ... show more 2026-09-01T01:27:44.884689 mail-honeypot postfix/submission/smtpd[25487]: warning: unknown[157.85.97.204]: SASL PLAIN authentication failed: authentication failure ... show less	Brute-Force
🇵🇾 SecOpsSL	2026-08-29 00:02:14 (3 weeks ago)	157.85.97.204 - - \[24/Aug/2026:07:48:54 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "- ... show more 157.85.97.204 - - \[24/Aug/2026:07:48:54 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 1 157.85.97.204 - - \[24/Aug/2026:08:15:19 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 1 157.85.97.204 - - \[24/Aug/2026:09:00:12 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 13 157.85.97.204 - - \[24/Aug/2026:09:04:52 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 0 157.85.97.204 - - \[24/Aug/2026:15:47:10 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 1 157.85.97.204 - - \[24/Aug/2026:15:49:29 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 1 157.85.97.204 - - \[24/Aug/2026:15:59:16 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 509 "-" "-" 1 157.85.97.204 - - \[24/Aug/2026:23:10:04 +0000\] "POST /service/admin/soap/ HTTP/1.1" 500 506 "-" "-" 1 show less	Hacking Web App Attack
🇿🇦 maximonline.co.za	2026-08-28 02:10:03 (3 weeks ago)	Brute Force SMTP AUTH Attack	Brute-Force
🇩🇪 LRob	2026-08-26 20:02:02 (3 weeks ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /xmlrpc.php \| 2026-08-26 20:02 UTC show less	Hacking Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 213.232.48.172

🇵🇦 200.46.151.238

🇳🇱 195.178.110.30

🇰🇷 112.171.134.40

🇳🇱 109.160.32.28

🇻🇳 103.72.56.174

🇨🇳 58.221.60.25

🇺🇸 18.221.179.104

🇨🇳 223.69.152.50

🇳🇱 195.178.110.105

🇩🇪 193.124.20.244

🇨🇦 192.99.138.227

🇧🇷 138.122.155.161

🇰🇷 106.245.246.26

🇮🇩 103.90.25.243

🇺🇸 74.7.244.7

🇱🇹 62.60.130.253

🇺🇸 47.254.36.112

🇺🇸 47.251.104.71

🇨🇳 42.51.41.252