JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.89.42.122

185.89.42.122 was found in our database!

This IP was reported 123 times. Confidence of Abuse is 15%: ?

15%

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS59651
Domain Name	finegroupservers.com
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.89.42.122

Whois 185.89.42.122

IP Abuse Reports for 185.89.42.122:

This IP address has been reported a total of 123 times from 11 distinct sources. 185.89.42.122 was first reported on November 23rd 2020, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-17 01:35:22 (15 hours ago)	(mod_security) mod_security (id:225170) triggered by 185.89.42.122 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.89.42.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 21:35:14.424153 2026] [security2:error] [pid 1818:tid 1818] [client 185.89.42.122:45039] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|emmtrucking.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "emmtrucking.com"] [uri "/wp-json/wp/v2/users"] [unique_id "almG0p5FqcIA2ktKdb-qawAAAAM"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 DRI	2026-07-16 20:08:56 (21 hours ago)	Web attack/Malicious activity detected	Web App Attack
🇺🇸 TPI-Abuse	2026-03-17 22:25:04 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 185.89.42.122 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.89.42.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 18:24:58.649561 2026] [security2:error] [pid 8268:tid 8268] [client 185.89.42.122:24545] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|sinsky.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sinsky.net"] [uri "/wp-json/wp/v2/users"] [unique_id "abnUumD3jRYUfFpjnymglQAAAAs"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-10 22:07:33 (9 months ago)	wordpress exploit scan	Web App Attack
🇨🇦 wil.com	2025-03-28 08:46:04 (1 year ago)	GlobalProtect login attempts with user ZResseguie.	VPN IP Brute-Force
🇨🇿 lp	2025-03-23 01:21:07 (1 year ago)	Unauthorized VPN login attempts: 2 attempts were recorded from 185.89.42.122 2025-03-23T01:50:23+01: ... show more Unauthorized VPN login attempts: 2 attempts were recorded from 185.89.42.122 2025-03-23T01:50:23+01:00 vpn Access-Reject 'accreditation' station: 185.89.42.122 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2025-03-23T02:14:22+01:00 vpn Access-Reject 'exploder' station: 185.89.42.122 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇺🇸 dpinse	2024-11-18 17:01:59 (1 year ago)	teler detected Directory Bruteforce against resource /robots.txt from 185.89.42.122	Bad Web Bot
🇩🇪 ps-center	2022-02-16 16:53:18 (4 years ago)	SS5,Magento Bruteforce Login Attack POST /index.php/admin/	Web Spam Bad Web Bot Web App Attack
🇩🇪 ps-center	2022-02-07 21:37:58 (4 years ago)	C1,Magento Bruteforce Login Attack POST /index.php/admin/	Web Spam Bad Web Bot Web App Attack
🇩🇪 ps-center	2022-02-03 23:46:10 (4 years ago)	SS5,Magento Bruteforce Login Attack POST /index.php/admin/	Web Spam Bad Web Bot Web App Attack
🇳🇱 xyz.rip	2022-02-03 15:40:43 (4 years ago)	Magento Bruteforce Attempt...	Brute-Force Web App Attack
🇩🇪 ps-center	2022-02-03 01:45:00 (4 years ago)	C1,Magento Bruteforce Login Attack POST /index.php/admin/	Web Spam Bad Web Bot Web App Attack
🇩🇪 TST	2022-01-27 22:33:49 (4 years ago)	hacker backend sniffing: /index.php/admin/	Hacking Web App Attack
🇳🇱 xyz.rip	2022-01-25 18:15:59 (4 years ago)	Magento Bruteforce Attempt...	Brute-Force Web App Attack
🇩🇪 ps-center	2022-01-21 13:09:53 (4 years ago)	SS5,Magento Bruteforce Login Attack POST /index.php/admin/	Web Spam Bad Web Bot Web App Attack

Showing 1 to 15 of 123 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 121.200.49.221

🇹🇷 94.154.43.230

🇷🇴 92.118.39.49

🇩🇪 80.158.109.51

🇧🇬 79.124.49.174

🇬🇧 5.226.140.61

🇺🇸 184.105.247.244

🇺🇸 162.216.149.11

🇺🇸 152.32.206.247

🇨🇳 118.113.15.18

🇺🇸 96.241.222.101

🇩🇪 69.5.169.222

🇹🇼 61.223.76.145

🇺🇸 192.178.65.17

🇧🇷 187.89.121.31

🇮🇳 103.69.26.3

🇹🇷 94.154.43.243

🇸🇪 83.233.147.8

🇫🇷 51.68.107.159

🇷🇺 5.101.198.154