JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.115.209.52

85.115.209.52 was found in our database!

This IP was reported 52 times. Confidence of Abuse is 100%: ?

100%

ISP	Internet Utilities Europe and Asia Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212810
Domain Name	netutils.io
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.115.209.52

Whois 85.115.209.52

IP Abuse Reports for 85.115.209.52:

This IP address has been reported a total of 52 times from 42 distinct sources. 85.115.209.52 was first reported on June 5th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 strxmpp	2026-06-07 03:05:46 (3 hours ago)	85.115.209.52 - - [07/Jun/2026:05:05:46 +0200] "GET /.env HTTP/1.1" 302 343 "-" "Mozilla/5.0 (Macint ... show more 85.115.209.52 - - [07/Jun/2026:05:05:46 +0200] "GET /.env HTTP/1.1" 302 343 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" ... show less	Bad Web Bot
🇳🇱 homeshowdomain.nl	2026-06-06 22:01:17 (8 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-05. show less	Web App Attack SSH Hacking
🇨🇭 4server	2026-06-06 20:49:15 (9 hours ago)	[SatJun0622:49:12.2969882026][security2:error][pid3878488:tid3878743][client85.115.209.52:0]ModSecur ... show more [SatJun0622:49:12.2969882026][security2:error][pid3878488:tid3878743][client85.115.209.52:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"hosting-domain-swiss-ch.ticino-hosting.ch\"][uri\"/.env.production\"][unique_id\"aiSHyOTklE44Tg5XcFa5yQAAANA\"] show less	Hacking Web App Attack
🇩🇪 LRob.fr	2026-06-06 20:00:03 (10 hours ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot
🇦🇺 Anytech	2026-06-06 18:17:47 (12 hours ago)	Blocked by Conn-Monitor: Web scanning activity	Hacking Web App Attack
🇩🇪 big-cloud.nl	2026-06-06 17:35:26 (13 hours ago)	Try to access /api/.env	Web App Attack
🇺🇸 TPI-Abuse	2026-06-06 17:12:28 (13 hours ago)	(mod_security) mod_security (id:949110) triggered by 85.115.209.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 85.115.209.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 13:12:21.299564 2026] [security2:error] [pid 6299:tid 6299] [client 85.115.209.52:48036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "gatewayacoustics.armstrongenvironmental.com"] [uri "/.git/HEAD"] [unique_id "aiRU9S1gpYFFY6ZyP93aXgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Zdeněk Svancar	2026-06-06 13:06:28 (17 hours ago)	85.115.209.52 - - [06/Jun/2026:13:06:26 +0000] "GET /api/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Wi ... show more 85.115.209.52 - - [06/Jun/2026:13:06:26 +0000] "GET /api/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 85.115.209.52 - - [06/Jun/2026:13:06:27 +0000] "GET /backend/.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15" ... show less	Port Scan Bad Web Bot Web App Attack
Anonymous	2026-06-06 09:30:18 (21 hours ago)	HEAD / HTTP/1.1 GET /.git/config HTTP/1.1 GET /.git/HEAD HTTP/1.1	Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-06-06 09:19:40 (21 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-06-06 09:01:12 (21 hours ago)	Bot / seems abusive / Apache connections: 51	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇫🇷 LRob.fr	2026-06-06 09:00:03 (21 hours ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇫🇷 masterguru	2026-06-06 08:48:20 (21 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇩🇪 DEV-DNS	2026-06-06 08:37:14 (21 hours ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇺🇸 xxkodedxx	2026-06-06 08:24:16 (22 hours ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 4× edge-block in 10 ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 4× edge-block in 10m window. Origin: GB / AS212810 GODLIKE DIGITAL SOLUTIONS S.R.L. Active: 08:23:55→08:23:56 UTC Volume: 4 HTTP req Probed: /, /.git/HEAD, /.git/config Status mix: 444×4 Vhost fishing: teachme.ztx-lab.com UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇭 41.242.115.84

🇧🇪 198.235.24.216

🇮🇳 152.52.87.147

🇺🇸 43.153.113.127

🇬🇧 35.203.211.246

🇺🇸 198.199.122.111

🇨🇦 178.93.200.55

🇧🇷 177.38.193.135

🇺🇸 162.216.149.141

🇸🇪 155.212.37.165

🇺🇸 147.185.132.40

🇸🇬 118.194.233.253

🇨🇳 110.249.201.161

🇧🇪 34.22.225.48

🇺🇸 17.246.19.153

🇪🇪 213.35.128.24

🇺🇸 172.104.11.34

🇻🇳 171.244.39.95

🇺🇸 166.62.41.190

🇹🇷 91.106.241.144