JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

85.121.121.213

Neutral Activity

Abuse confidence score ?

0% Low Risk

19 reports

12 reporters · latest 4 months ago

ISP	Urban Network Solutions SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	urbannetworksolutions.nl
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	London, England

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

85.121.121.213 has been reported 19 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 85.121.121.213

Export CSV

This IP address has been reported a total of 19 times from 12 distinct sources. 85.121.121.213 was first reported on May 28th 2026, and the most recent report was 4 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 SSH-Admin	2026-05-29 14:00:05 (4 months ago)	Probing for Exploits on ns200	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 13:05:47 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 09:05:41.737854 2026] [security2:error] [pid 28051:tid 28051] [client 85.121.121.213:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "southernbroadcast.com"] [uri "/public/.env"] [unique_id "ahmPJWKIuDk_soOjEX1tNgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 SSH-Admin	2026-05-29 12:55:03 (4 months ago)	Probing for Exploits on ns74	Exploited Host Web App Attack
Anonymous	2026-05-29 12:19:53 (4 months ago)	(caddyscan) Scanner path probe from 85.121.121.213 (RO/Romania/-): 5 in the last 3600 secs; Ports: * ... show more (caddyscan) Scanner path probe from 85.121.121.213 (RO/Romania/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 85.121.121.213 - - [29/May/2026:12:19:50 +0000] "GET /.ssh/id_rsa HTTP/1.1" [REDACTED] 200 2627 85.121.121.213 - - [29/May/2026:12:19:50 +0000] "GET /.env.backup HTTP/1.1" [REDACTED] 200 2627 85.121.121.213 - - [29/May/2026:12:19:50 +0000] "GET /api/.env HTTP/1.1" [REDACTED] 200 2627 85.121.121.213 - - [29/May/2026:12:19:50 +0000] "GET /.env.bak HTTP/1.1" [REDACTED] 200 2627 85.121.121.213 - - [29/May/2026:12:19:50 +0000] "GET /.env.production HTTP/1.1" show less	Port Scan
🇺🇸 Matthew Ping	2026-05-29 12:00:02 (4 months ago)	ModSecurity rule 949110 triggered on wp1. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
Anonymous	2026-05-29 11:56:07 (4 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 vanguardm	2026-05-29 10:25:03 (4 months ago)	Automated report: 194 events detected. Types: web-attack	Web App Attack
🇺🇸 Matthew Ping	2026-05-29 10:15:02 (4 months ago)	ModSecurity rule 949110 triggered on dedicated4785. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
Anonymous	2026-05-29 10:00:00 (4 months ago)	Ports: *; Direction: 0; Trigger: CT_LIMIT	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-29 09:32:43 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 05:32:37.751758 2026] [security2:error] [pid 20451:tid 20451] [client 85.121.121.213:54124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "realtorpaul.com"] [uri "/.env.bak"] [unique_id "ahldNRrMT-UiSom0bUc92QAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 09:15:13 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 05:15:08.432916 2026] [security2:error] [pid 31269:tid 31269] [client 85.121.121.213:34260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rahmanou.com"] [uri "/.env.production"] [unique_id "ahlZHArGeuJ1Bo91ZI81iwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 08:59:21 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 04:59:13.527321 2026] [security2:error] [pid 24912:tid 24934] [client 85.121.121.213:35508] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|pyro-one.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pyro-one.com"] [uri "/storage/logs/laravel.log"] [unique_id "ahlVYf2xIGaCwv9FYtSitAAAAJA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 08:44:19 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 04:44:14.846506 2026] [security2:error] [pid 31877:tid 31877] [client 85.121.121.213:47180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ps-omega.com"] [uri "/.env.example"] [unique_id "ahlR3l-nfZHgmYJAzNmemQAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-05-28 19:01:31 (4 months ago)	Multiple WAF Violations	Web App Attack
🇫🇷 vincent_EUDIER	2026-05-28 17:00:01 (4 months ago)	SURICATA HTTP unable to match response to request	Hacking

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 194.88.98.107

🇪🇨 186.68.83.104

🇦🇷 186.22.253.143

🇬🇪 185.99.5.110

🇵🇦 179.43.153.2

🇺🇸 170.215.162.68

🇰🇷 119.192.128.163

🇨🇳 114.96.79.13

🇭🇰 104.208.108.166

🇳🇱 94.154.43.163

🇳🇱 94.154.43.140

🇩🇪 77.243.88.95

🇳🇱 193.47.62.187

🇺🇸 162.216.150.21

🇰🇪 129.222.147.99

🇳🇱 94.154.43.103

🇳🇱 94.154.43.12

🇸🇾 89.43.135.135

🇷🇴 80.94.95.245

🇺🇸 73.245.245.182