JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.107.1.125

85.107.1.125 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 92%: ?

92%

ISP	Turk Telekomunikasyon Anonim Sirketi
Usage Type	Fixed Line ISP
ASN	AS9121
Hostname(s)	85.107.1.125.dynamic.ttnet.com.tr
Domain Name	turktelekom.com.tr
Country	🇹🇷 Turkey
City	Istanbul, Istanbul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.107.1.125

Whois 85.107.1.125

IP Abuse Reports for 85.107.1.125:

This IP address has been reported a total of 22 times from 18 distinct sources. 85.107.1.125 was first reported on August 11th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 bescared	2026-08-21 17:26:36 (1 hour ago)	F2B - Malicious activity detected. URL Probing. -8ff06ede-	Hacking Bad Web Bot Web App Attack
🇩🇪 stinpriza	2026-08-21 13:48:51 (4 hours ago)	Web App Attack	Web App Attack
🇳🇱 Site.eu	2026-08-21 13:34:40 (4 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 big-cloud.nl	2026-08-21 13:26:12 (5 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇦🇺 screwlooseit.com.au	2026-08-20 14:46:07 (1 day ago)	Blocked by CSF 13 firewall - Rule: XMLRPC TR/Turkey/85.107.1.125.dynamic.ttnet.com.tr	Web App Attack
🇧🇪 madeit	2026-08-20 10:57:11 (1 day ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 15:51:38 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 85.107.1.125 (85.107.1.125.dynamic.ttnet.com.tr ... show more (mod_security) mod_security (id:225170) triggered by 85.107.1.125 (85.107.1.125.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 11:51:31.837113 2026] [security2:error] [pid 7992:tid 7992] [client 85.107.1.125:58869] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|brianwhitty.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "brianwhitty.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoMuAyLB3idXwYPe40BtLgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 IndigoRidge	2026-08-16 22:45:38 (4 days ago)	85.107.1.125 - - [16/Aug/2026:18:44:14 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 ... show more 85.107.1.125 - - [16/Aug/2026:18:44:14 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 85.107.1.125 - - [16/Aug/2026:18:44:36 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.0.0 Safari/537.36" 85.107.1.125 - - [16/Aug/2026:18:44:55 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" 85.107.1.125 - - [16/Aug/2026:18:45:17 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/82.0.0.0 Safari/537.36" 85.107.1.125 - - [16/Aug/2026:18:45:37 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5279 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/7 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-16 20:57:55 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 85.107.1.125 (85.107.1.125.dynamic.ttnet.com.tr ... show more (mod_security) mod_security (id:225170) triggered by 85.107.1.125 (85.107.1.125.dynamic.ttnet.com.tr): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 16:57:52.290646 2026] [security2:error] [pid 9450:tid 9450] [client 85.107.1.125:61032] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|clipper1970.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "clipper1970.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoIkUAUnNsiKCxUQID-mBQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-16 15:08:18 (5 days ago)	(wordpress) Failed wordpress login from 85.107.1.125 (TR/Türkiye/85.107.1.125.dynamic.ttnet.com.tr)	Brute-Force
🇫🇷 mail.avx.gr	2026-08-16 01:11:37 (5 days ago)	Plesk Fail2Ban jail: Plesk-WebScanners. Evidence: 85.107.1.125 - - [16/Aug/2026:04:11:37 +0300] "POS ... show more Plesk Fail2Ban jail: Plesk-WebScanners. Evidence: 85.107.1.125 - - [16/Aug/2026:04:11:37 +0300] "POST /xmlrpc.php HTTP/2.0" 403 146 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/62.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 WeekendWeb	2026-08-14 16:00:16 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇳🇿 Tripwire	2026-08-13 19:14:57 (1 week ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
Anonymous	2026-08-13 11:27:57 (1 week ago)	85.107.1.125 - - [13/Aug/2026:19:27:56 +0800] "POST /xmlrpc.php HTTP/1.1" 404 16 "-" "Mozilla/5.0 (W ... show more 85.107.1.125 - - [13/Aug/2026:19:27:56 +0800] "POST /xmlrpc.php HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇬🇷 setupgr	2026-08-13 10:33:24 (1 week ago)	(XMLRPC) WP XMLRPC Attack 85.107.1.125 (TR/Turkey/Ankara/Ankara/-/[AS9121 TTNET]): 1 in the last 864 ... show more (XMLRPC) WP XMLRPC Attack 85.107.1.125 (TR/Turkey/Ankara/Ankara/-/[AS9121 TTNET]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 85.107.1.125 - - [13/Aug/2026:13:32:41 +0300] "POST /xmlrpc.php HTTP/2.0" 403 - "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0 Safari/537.36" show less	Port Scan

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a03:2880:f806:11::

🇨🇳 223.80.239.218

🇨🇳 117.151.199.59

🇳🇱 94.154.43.129

🇬🇧 35.203.211.172

🇺🇸 35.94.99.3

🇺🇸 147.185.132.135

🇭🇰 119.8.57.189

🇳🇱 45.148.10.152

🇺🇸 34.26.50.60

🇧🇪 198.235.24.225

🇵🇰 103.166.103.173

🇯🇵 101.36.104.242

🇷🇴 92.118.39.228

🇮🇷 85.133.193.72

🇭🇰 49.0.245.65

🇲🇽 46.250.174.55

🇲🇽 46.250.169.203

🇬🇧 35.203.211.73

🇳🇱 2a06:1700:3:19::1