JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

85.121.121.223

Neutral Activity

Abuse confidence score ?

0% Low Risk

20 reports

8 reporters · latest 4 months ago

ISP	Urban Network Solutions SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	urbannetworksolutions.nl
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	London, England

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

85.121.121.223 has been reported 20 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 85.121.121.223

Export CSV

This IP address has been reported a total of 20 times from 8 distinct sources. 85.121.121.223 was first reported on May 28th 2026, and the most recent report was 4 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-29 13:27:09 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 09:27:05.022427 2026] [security2:error] [pid 23554:tid 23554] [client 85.121.121.223:49114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fancycleaners.com"] [uri "/admin/.env"] [unique_id "ahmUKSvp-YZJvTLEVl2C_QAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 12:29:48 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 08:29:40.511259 2026] [security2:error] [pid 3761:tid 3761] [client 85.121.121.223:33878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.emailaegis.com"] [uri "/.env.example"] [unique_id "ahmGtNWq4-ejtyXR1kptxwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-29 12:25:27 (4 months ago)	Ports: *; Direction: 0; Trigger: CT_LIMIT	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-29 10:52:28 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 06:52:21.953466 2026] [security2:error] [pid 21600:tid 21600] [client 85.121.121.223:38244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dinkusdrums.com"] [uri "/.env.production"] [unique_id "ahlv5WDdKTioCY4x4_K-agAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 10:21:09 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 06:21:05.822154 2026] [security2:error] [pid 23560:tid 23560] [client 85.121.121.223:42462] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "deckmasterscompany.com"] [uri "/.env.test"] [unique_id "ahlokWggPwZiomHEIwaYnAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 10:01:53 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 06:01:49.790576 2026] [security2:error] [pid 30100:tid 30100] [client 85.121.121.223:57180] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|damgoodit.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "damgoodit.com"] [uri "/storage/logs/laravel.log"] [unique_id "ahlkDQacKKsrtMb0DhtCsQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 09:44:41 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 05:44:36.663083 2026] [security2:error] [pid 6438:tid 6438] [client 85.121.121.223:51026] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "csme-eprr.com"] [uri "/app/.env"] [unique_id "ahlgBEhwMERBJzAGckGQyAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 09:25:33 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 05:25:26.988556 2026] [security2:error] [pid 26132:tid 26132] [client 85.121.121.223:48916] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "countrysideinnkingston.com"] [uri "/public/.env"] [unique_id "ahlbhjoIvToa506r7jdkWQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-29 09:21:32 (4 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-29 09:05:34 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 05:05:30.759918 2026] [security2:error] [pid 15499:tid 15499] [client 85.121.121.223:56898] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "concertosupport.com"] [uri "/.env.development"] [unique_id "ahlW2o0_AxzIB7ZUttlukAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 08:50:29 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 04:50:24.072214 2026] [security2:error] [pid 20218:tid 20218] [client 85.121.121.223:50864] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coffeewitheinstein.com"] [uri "/admin/.env"] [unique_id "ahlTUKiWcsXhtdeLkrrx3wAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 vanguardm	2026-05-29 08:50:03 (4 months ago)	Automated report: 126 events detected. Types: web-attack	Web App Attack
Anonymous	2026-05-29 08:42:03 (4 months ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇫🇷 dynamix	2026-05-29 08:40:32 (4 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 08:33:02 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.121.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 04:32:57.417515 2026] [security2:error] [pid 1984:tid 1984] [client 85.121.121.223:35908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.climasyequipos.com"] [uri "/.env.backup"] [unique_id "ahlPOfBkZxnK0XAo9asC7QAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 203.159.90.90

🇵🇰 154.192.120.16

🇸🇬 134.185.88.23

🇺🇸 98.190.40.102

🇷🇺 31.40.146.255

🇧🇷 16.5.0.182

🇧🇷 2804:4028:109:7101:d15:513c:2b9c:4b36

🇹🇳 197.5.145.102

🇳🇱 185.136.15.80

🇺🇸 174.85.169.109

🇺🇸 168.100.149.130

🇩🇪 167.94.145.23

🇸🇬 165.154.236.104

🇺🇸 136.226.49.85

🇺🇸 50.6.206.236

🇵🇪 38.250.131.23

🇨🇱 186.79.129.132

🇳🇱 185.223.235.54

🇨🇦 172.70.80.105

🇨🇳 119.23.110.193