JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.103.107.90

85.103.107.90 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 53%: ?

53%

ISP	Turk Telekomunikasyon Anonim Sirketi
Usage Type	Fixed Line ISP
ASN	AS9121
Hostname(s)	85.103.107.90.dynamic.ttnet.com.tr
Domain Name	turktelekom.com.tr
Country	🇹🇷 Turkey
City	Istanbul, Istanbul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.103.107.90

Whois 85.103.107.90

IP Abuse Reports for 85.103.107.90:

This IP address has been reported a total of 14 times from 9 distinct sources. 85.103.107.90 was first reported on September 27th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-20 19:46:27 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com. ... show more (mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 15:46:22.519283 2026] [security2:error] [pid 1813171:tid 1813171] [client 85.103.107.90:51449] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 85.103.107.90 (+1 hits since last alert)\|guarinofurnituredesigns.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "guarinofurnituredesigns.com"] [uri "/xmlrpc.php"] [unique_id "al57Ds4AqwXmrI33MBnyHQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 18:44:05 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com. ... show more (mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 14:44:00.066051 2026] [security2:error] [pid 3334342:tid 3334342] [client 85.103.107.90:49714] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 85.103.107.90 (+1 hits since last alert)\|mfleetservice.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mfleetservice.com"] [uri "/xmlrpc.php"] [unique_id "al5scIYGsD5h0oYkKXgy7wAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-07-19 15:57:01 (2 days ago)	(wordpress) Failed wordpress login from 85.103.107.90 (TR/Türkiye/85.103.107.90.dynamic.ttnet.com.tr ... show more (wordpress) Failed wordpress login from 85.103.107.90 (TR/Türkiye/85.103.107.90.dynamic.ttnet.com.tr) show less	Brute-Force
🇫🇷 dynamix	2026-07-19 09:36:54 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-07-19 08:51:01 (2 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-19 08:35:11 (2 days ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 06:36:19 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com. ... show more (mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 02:36:13.804960 2026] [security2:error] [pid 19042:tid 19042] [client 85.103.107.90:51071] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 85.103.107.90 (+1 hits since last alert)\|shelbysmoak.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "shelbysmoak.com"] [uri "/xmlrpc.php"] [unique_id "alxwXQfxGnEIBP_jIenZfwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ConsulHosting	2026-07-18 18:04:08 (3 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
Anonymous	2026-07-18 17:16:31 (3 days ago)	[redacted] 85.103.107.90 - - [18/Jul/2026:19:15:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "J ... show more [redacted] 85.103.107.90 - - [18/Jul/2026:19:15:48 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 85.103.107.90 - - [18/Jul/2026:19:15:59 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 85.103.107.90 - - [18/Jul/2026:19:16:09 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 85.103.107.90 - - [18/Jul/2026:19:16:20 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 85.103.107.90 - - [18/Jul/2026:19:16:30 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" ... show less	Hacking Web App Attack
🇺🇸 cwytech	2026-07-18 17:15:36 (3 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 10:14:10 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com. ... show more (mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 06:14:06.027086 2026] [security2:error] [pid 651526:tid 651526] [client 85.103.107.90:49765] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 85.103.107.90 (+1 hits since last alert)\|takeapawsboston.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "takeapawsboston.com"] [uri "/xmlrpc.php"] [unique_id "altR7hS64Pm62WY8LjRjwwAAACc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 17:04:50 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com. ... show more (mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 13:04:46.195290 2026] [security2:error] [pid 15390:tid 15390] [client 85.103.107.90:53208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 85.103.107.90 (+1 hits since last alert)\|illumoonatedtarot.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "illumoonatedtarot.com"] [uri "/xmlrpc.php"] [unique_id "alkPLlc9sDUnyLLw5kV2XQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 14:03:40 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com. ... show more (mod_security) mod_security (id:240335) triggered by 85.103.107.90 (85.103.107.90.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 10:03:33.583432 2026] [security2:error] [pid 11548:tid 11548] [client 85.103.107.90:51883] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 85.103.107.90 (+1 hits since last alert)\|dancingbearprinting.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dancingbearprinting.com"] [uri "/xmlrpc.php"] [unique_id "aleTNVxlsVGWFssBafFwPwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇸 Smel	2024-09-27 08:34:15 (1 year ago)	Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -	Email Spam Hacking Brute-Force

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 165.154.236.29

🇺🇸 209.141.41.212

🇲🇽 186.96.145.241

🇳🇱 178.128.136.57

🇧🇷 143.0.58.85

🇺🇸 2603:6000:8f00:9303:705c:dee:d503:8d45

🇧🇷 200.11.122.251

🇷🇼 197.243.18.136

🇨🇦 142.44.220.70

🇹🇷 94.154.43.69

🇭🇰 46.247.61.246

🇧🇷 45.205.1.247

🇺🇸 45.33.12.214

🇱🇰 203.189.190.147

🇳🇱 176.65.148.244

🇺🇸 172.202.37.160

🇫🇷 167.86.66.42

🇺🇸 157.245.1.7

🇺🇸 152.32.149.35

🇨🇳 123.56.7.43