JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.121.127.152

85.121.127.152 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 100%: ?

100%

ISP	Urban Network Solutions SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	urbannetworksolutions.nl
Country	🇳🇱 Netherlands
City	The Hague, South Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.121.127.152

Whois 85.121.127.152

IP Abuse Reports for 85.121.127.152:

This IP address has been reported a total of 41 times from 23 distinct sources. 85.121.127.152 was first reported on June 5th 2026, and the most recent report was 35 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 URAN Publishing Service	2026-06-06 20:54:10 (35 minutes ago)	85.121.127.152 - - [06/Jun/2026:23:54:09 +0300] "GET /.env HTTP/1.1" 404 650 "-" "Mozilla/5.0 (compa ... show more 85.121.127.152 - - [06/Jun/2026:23:54:09 +0300] "GET /.env HTTP/1.1" 404 650 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇬🇧 consul.to	2026-06-06 20:17:04 (1 hour ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇦 URAN Publishing Service	2026-06-06 19:43:44 (1 hour ago)	85.121.127.152 - - [06/Jun/2026:22:43:42 +0300] "GET /.env HTTP/1.1" 404 650 "-" "Mozilla/5.0 AppleW ... show more 85.121.127.152 - - [06/Jun/2026:22:43:42 +0300] "GET /.env HTTP/1.1" 404 650 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.2; +https://openai.com/gptbot" 85.121.127.152 - - [06/Jun/2026:22:43:44 +0300] "GET /config.env HTTP/1.1" 404 650 "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇨🇭 SOC [GOLINE SA]	2026-06-06 17:01:45 (4 hours ago)	FortiGate detected IPS attack from IPv4 address 85.121.127.152	Hacking
Anonymous	2026-06-06 16:46:35 (4 hours ago)	85.121.127.152 - - [06/Jun/2026:18:46:35 +0200] "GET /.env.old HTTP/1.1" 402 816 "-" "Mozilla/5.0 (c ... show more 85.121.127.152 - - [06/Jun/2026:18:46:35 +0200] "GET /.env.old HTTP/1.1" 402 816 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇹🇷 baku.hosting	2026-06-06 16:20:28 (5 hours ago)	CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 85.121.127.152 (NL/The Netherl ... show more CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 85.121.127.152 (NL/The Netherlands/-): 5 in the last 3600 secs show less	Brute-Force Web App Attack
Anonymous	2026-06-06 16:19:02 (5 hours ago)	Bot / scanning and/or hacking attempts: GET /.aws/credentials HTTP/2.0, GET /secrets.yml HTTP/2.0, G ... show more Bot / scanning and/or hacking attempts: GET /.aws/credentials HTTP/2.0, GET /secrets.yml HTTP/2.0, GET /api/v1/settings HTTP/2.0, GET /v1/graphql HTTP/2.0, GET /__/firebase/init.json HTTP/2.0, GET /config.json HTTP/2.0, GET /application.properties HTTP/2.0, GET /secrets.json HTTP/2.0, GET /config/secrets.yml HTTP/2.0, GET /api/.env HTTP/2.0, GET /debug/pprof/cmdline HTTP/2.0, GET /.env.production HTTP/2.0, GET /config.env HTTP/2.0, GET /robots.txt HTTP/2.0, GET /.env.old HTTP/2.0, GET /.env.example HTTP/2.0, GET /.env.staging HTTP/2.0, GET /.env.development HTTP/2.0, GET /storage/logs/laravel.log HTTP/2.0, GET / HTTP/2.0, GET /application.yml HTTP/2.0, GET /sitemap.xml HTTP/2.0, GET /.env.backup HTTP/2.0, GET /.env.local HTTP/2.0, GET /.env HTTP/2.0, GET /.git/config HTTP/2.0 show less	Hacking Web App Attack
🇺🇸 conrad10781	2026-06-06 16:14:54 (5 hours ago)	nginx-4xx	Web App Attack
🇺🇸 TPI-Abuse	2026-06-06 16:11:31 (5 hours ago)	(mod_security) mod_security (id:949110) triggered by 85.121.127.152 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:949110) triggered by 85.121.127.152 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 12:11:23.867809 2026] [security2:error] [pid 20688:tid 20688] [client 85.121.127.152:56658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosting.freedrm.org"] [uri "/.git/config"] [unique_id "aiRGq9tWdXMJHW1HV-6kWQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-06-06 16:07:41 (5 hours ago)	[SatJun0618:07:37.9535802026][security2:error][pid2880842:tid2882485][client85.121.127.152:0]ModSecu ... show more [SatJun0618:07:37.9535802026][security2:error][pid2880842:tid2882485][client85.121.127.152:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"hosting-dominio.ch\"][uri\"/.aws/credentials\"][unique_id\"aiRFye_BSn0mdYl73_jV3QAAAQM\"] show less	Hacking Web App Attack
🇩🇪 Hary74656	2026-06-06 16:05:52 (5 hours ago)	[Sat Jun 06 18:05:43.480771 2026] [security2:error] [pid 319243:tid 319266] [remote 85.121.127.152:3 ... show more [Sat Jun 06 18:05:43.480771 2026] [security2:error] [pid 319243:tid 319266] [remote 85.121.127.152:33162] [client 85.121.127.152] ModSecurity: Access denied with code 403 (phase 2). String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "hoster.weaver ... show less	Web App Attack
🇳🇱 e.fierstra	2026-06-06 16:04:37 (5 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-06 09:39:54 (11 hours ago)	Excessive multi-domain requests	Brute-Force
🇫🇷 masterguru	2026-06-06 09:03:40 (12 hours ago)	Restricted File Access Attempt. Matched phrase "/.git/" at REQUEST_FILENAME. (930130-131)	Hacking Web App Attack
🇺🇸 JustMeHere	2026-06-06 03:13:46 (18 hours ago)	[Fri Jun 05 23:13:39.084603 2026] [security2:error] [pid 42831:tid 42868] [client 85.121.127.152:511 ... show more [Fri Jun 05 23:13:39.084603 2026] [security2:error] [pid 42831:tid 42868] [client 85.121.127.152:51164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "mail.yorknation.com"] [uri "/.aws/credentials"] [unique_id "aiOQY8RkUVDcOF8OytsaRQAAAQk"], referer: http://mail.yorknation.com/.aws/credentials ... show less	Web App Attack

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.56

🇬🇧 213.166.84.54

🇧🇷 187.16.96.250

🇺🇸 107.150.146.69

🇷🇴 80.94.92.186

🇺🇸 71.41.197.10

🇺🇸 52.54.15.103

🇺🇸 45.156.129.178

🇷🇴 2.57.121.25

🇺🇸 216.180.246.156

🇨🇴 190.60.49.242

🇧🇬 78.128.114.58

🇳🇱 45.148.10.141

🇩🇿 41.96.74.39

🇧🇷 187.33.59.116

🇺🇸 165.154.173.83

🇪🇸 141.109.168.108

🇬🇧 94.156.250.197

🇨🇿 90.180.55.166

🇰🇷 59.21.37.60