JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 181.85.209.13

181.85.209.13 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 21%: ?

21%

ISP	Núcleo S.A.
Usage Type	Fixed Line ISP
ASN	AS27895
Hostname(s)	181.85.209.13.ptr.personal.net.py
Domain Name	personal.com.py
Country	🇵🇾 Paraguay
City	San Lorenzo, Central Department

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 181.85.209.13

Whois 181.85.209.13

IP Abuse Reports for 181.85.209.13:

This IP address has been reported a total of 13 times from 10 distinct sources. 181.85.209.13 was first reported on February 21st 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-26 20:30:15 (4 hours ago)	(mod_security) mod_security (id:210350) triggered by 181.85.209.13 (181.85.209.13.ptr.personal.net.p ... show more (mod_security) mod_security (id:210350) triggered by 181.85.209.13 (181.85.209.13.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 16:29:59.822782 2026] [security2:error] [pid 27296:tid 27296] [client 181.85.209.13:43764] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|noramsg.com\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "noramsg.com"] [uri "/"] [unique_id "at-4R694BPYhM4pXyg-KXwAAAAM"], referer: https://five.co.in/redirect.php?ref_host=brazilianblades.org show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-26 18:55:06 (6 hours ago)	(mod_security) mod_security (id:210350) triggered by 181.85.209.13 (181.85.209.13.ptr.personal.net.p ... show more (mod_security) mod_security (id:210350) triggered by 181.85.209.13 (181.85.209.13.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 14:54:54.865432 2026] [security2:error] [pid 21249:tid 21249] [client 181.85.209.13:32412] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|polar-design.com\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "polar-design.com"] [uri "/"] [unique_id "at-h_pNAr9caxUIA6NB17AAAAAc"], referer: https://five.co.in/redirect.php?ref_host=piecenashville.com show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 sefinek.net	2026-10-21 12:26:12 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from PY. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from PY. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /booru/search \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-28 20:28:02 (4 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-26 10:01:05 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 181.85.209.13 (181.85.209.13.ptr.personal.net.p ... show more (mod_security) mod_security (id:210492) triggered by 181.85.209.13 (181.85.209.13.ptr.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 06:00:43.821554 2026] [security2:error] [pid 32163:tid 32163] [client 181.85.209.13:23795] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "picayunity.com"] [uri "/apps/.env.temp"] [unique_id "areXy4BwrJXxkZeWCfTsGQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-07-19 19:27:17 (3 months ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇺🇸 stechusa	2026-07-12 08:12:20 (3 months ago)	ELEVATED_THREAT \| 40 IPs targeting /brand/satco-products-inc/satco-light-bulbs.html \| URL template s ... show more ELEVATED_THREAT \| 40 IPs targeting /brand/satco-products-inc/satco-light-bulbs.html \| URL template shared by 5 IPs: /brand/satco-products-inc/satco-light-bulbs.html?bulb_base_type=&bulb_shape=&d \| Facet request during elevated threat (facet_ratio=0.97, unique_ips=442) show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-07-08 21:12:14 (3 months ago)	ELEVATED_THREAT \| 562 IPs targeting /brand.html \| URL template shared by 216 IPs: /brand.html?bulb_s ... show more ELEVATED_THREAT \| 562 IPs targeting /brand.html \| URL template shared by 216 IPs: /brand.html?bulb_shape_type=&bulb_shape=&bulb_type=&mode=list&p= \| Facet request during elevated threat (facet_ratio=0.97, unique_ips=797) show less	Bad Web Bot DDoS Attack
🇫🇷 Tilellit.PRO	2026-06-10 10:19:38 (4 months ago)	Fail2Ban banned 181.85.209.13 for security violations in jail wp-armour. Log: 2026/06/10 10:19:37 [e ... show more Fail2Ban banned 181.85.209.13 for security violations in jail wp-armour. Log: 2026/06/10 10:19:37 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 181.85.209.13 \| Target: wplogin" , client: 181.85.209.13, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
Anonymous	2026-05-05 01:06:27 (5 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇷🇴 INTEQ	2026-05-01 03:00:46 (5 months ago)	Web attack from 181.85.209.13	Web App Attack
🇺🇸 kosada.com	2026-02-25 16:19:43 (8 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
Anonymous	2026-02-21 07:23:32 (8 months ago)	scanning http requests from known botnet	Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 185.247.137.81

🇦🇷 181.228.80.171

🇨🇭 179.43.153.2

🇨🇳 118.145.107.219

🇺🇦 94.178.193.19

🇬🇧 90.222.120.142

🇰🇷 43.133.255.216

🇺🇸 216.25.89.120

🇺🇸 199.165.159.120

🇦🇷 181.25.197.234

🇳🇱 176.65.132.251

🇺🇸 172.98.32.108

🇺🇸 136.242.96.98

🇩🇪 92.118.12.45

🇺🇸 48.47.30.171

🇨🇦 45.198.224.20

🇧🇷 45.70.0.140

🇨🇳 36.106.166.98

🇺🇸 18.117.74.43

🇫🇮 13.140.86.214