JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.121.208.117

85.121.208.117 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 98%: ?

98%

ISP	Urban Network Solutions SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	urbannetworksolutions.nl
Country	🇷🇴 Romania
City	Bucharest, Bucharest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.121.208.117

Whois 85.121.208.117

IP Abuse Reports for 85.121.208.117:

This IP address has been reported a total of 20 times from 18 distinct sources. 85.121.208.117 was first reported on July 8th 2026, and the most recent report was 11 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 MarkGGN	2026-07-09 02:49:37 (11 minutes ago)	Web attack. 85.121.208.117 - - [09/Jul/2026:04:49:36 +0200] "GET /.env HTTP/1.1" 403 97 "-" "Mozilla ... show more Web attack. 85.121.208.117 - - [09/Jul/2026:04:49:36 +0200] "GET /.env HTTP/1.1" 403 97 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0" 85.121.208.117 - - [09/Jul/2026:04:49:36 +0200] "GET /.git/config HTTP/1.1" 403 140 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" show less	Web App Attack
🇳🇱 Site.eu	2026-07-09 02:48:07 (13 minutes ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 Matthew Ping	2026-07-09 01:45:15 (1 hour ago)	ModSecurity rule 949110 triggered on dedicated4785. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇷🇴 iulianh	2026-07-09 01:41:49 (1 hour ago)	*	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-09 00:13:36 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 85.121.208.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.208.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 20:13:28.942088 2026] [security2:error] [pid 22590:tid 22772] [client 85.121.208.117:33756] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "royallawsociety.com.aafm.us"] [uri "/.git/HEAD"] [unique_id "ak7nqHlwUu9tA32ouzDIQAAAAkk"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 lns.bz	2026-07-08 22:59:21 (4 hours ago)	Web app attack [PL.Lu]	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 22:52:31 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 85.121.208.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.208.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 18:52:23.513833 2026] [security2:error] [pid 11957:tid 11957] [client 85.121.208.117:42806] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "san-marino-marine-consulting.com"] [uri "/.git/HEAD"] [unique_id "ak7Up1ycW77P4RqhtxlxAQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-08 22:40:59 (4 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 Gwyneth Llewelyn	2026-07-08 22:11:31 (4 hours ago)	2026/07/08 23:11:29 [error] 2215#2215: 1505384 access forbidden by rule, client: 85.121.208.117, se ... show more 2026/07/08 23:11:29 [error] 2215#2215: 1505384 access forbidden by rule, client: 85.121.208.117, server: simetria.org, request: "GET /.env HTTP/2.0", host: "simetria.org" 85.121.208.117 - - [08/Jul/2026:23:11:29 +0100] "GET /.env HTTP/2.0" 403 1045 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0" 2026/07/08 23:11:29 [error] 2216#2216: *1505392 access forbidden by rule, client: 85.121.208.117, server: simetria.org, request: "GET /api/.env HTTP/2.0", host: "simetria.org" show less	Brute-Force Web App Attack
Anonymous	2026-07-08 22:09:02 (4 hours ago)	Bot / scanning and/or hacking attempts: GET /.aws/credentials HTTP/1.1, GET /.env.production HTTP/1. ... show more Bot / scanning and/or hacking attempts: GET /.aws/credentials HTTP/1.1, GET /.env.production HTTP/1.1, GET /config.json HTTP/1.1, GET /env HTTP/1.1, GET /.env.local HTTP/1.1, GET /api/.env HTTP/1.1, GET /.env.development HTTP/1.1, GET /.git/HEAD HTTP/1.1, GET /wp-content/plugins/revslider/public/js/sr7.js?ver=6.7.55 H, GET /wp-content/themes/Total/assets/js/frontend/core.min.js?ver, GET / HTTP/1.1, GET /.git/config HTTP/1.1, GET /wp-content/plugins/revslider/public/js/libs/tptools.js?ver, GET /.env HTTP/1.1, HEAD / HTTP/1.1, GET /wp-content/plugins/contact-form-7/modules/recaptcha/index., GET /js/config.js HTTP/1.1, GET /wp-includes/js/dist/i18n.min.js?ver=781d11515ad3d91786ec H, GET /wp-content/plugins/contact-form-7/includes/swv/js/index.js, GET /backend/.env HTTP/1.1, GET /wp-content/themes/Total/assets/js/frontend/mobile-menu/sid show less	Hacking Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-08 22:01:17 (5 hours ago)	Auto-ban: >3000 req/min op 2026-07-08	Web App Attack SSH Hacking
🇫🇷 dynamix	2026-07-08 21:35:44 (5 hours ago)	Multiple WAF Violations	Web App Attack
🇫🇮 inlink.ltd	2026-07-08 21:21:31 (5 hours ago)	dot file probe	Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 21:20:28 (5 hours ago)	(mod_security) mod_security (id:210492) triggered by 85.121.208.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.208.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 17:20:22.177708 2026] [security2:error] [pid 6022:tid 6146] [client 85.121.208.117:36236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rudimentseq.com"] [uri "/.git/HEAD"] [unique_id "ak6_Fo5ATeuzxAGdHW7ORQAAAko"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-07-08 20:00:25 (7 hours ago)	7.291 requests in 1 hour (1w11h59m)	Brute-Force Bad Web Bot

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2001:470:1:fb5::186

🇧🇬 193.24.211.247

🇬🇧 188.240.59.22

🇸🇦 188.49.23.170

🇸🇬 165.154.236.104

🇺🇸 162.216.150.245

🇺🇸 162.216.150.99

🇯🇵 152.32.204.21

🇨🇳 120.82.83.126

🇫🇷 85.217.140.42

🇸🇦 82.167.182.135

🇺🇸 45.8.19.179

🇺🇸 44.2.158.200

🇬🇧 213.166.84.35

🇫🇷 213.136.81.58

🇮🇷 188.136.213.186

🇲🇽 187.190.180.105

🇧🇷 187.16.99.234

🇹🇷 185.226.93.125

🇺🇸 185.199.92.29