JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.121.208.40

85.121.208.40 was found in our database!

This IP was reported 59 times. Confidence of Abuse is 100%: ?

100%

ISP	Urban Network Solutions SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	urbannetworksolutions.nl
Country	🇷🇴 Romania
City	Bucharest, Bucharest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.121.208.40

Whois 85.121.208.40

IP Abuse Reports for 85.121.208.40:

This IP address has been reported a total of 59 times from 49 distinct sources. 85.121.208.40 was first reported on July 8th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Holger	2026-07-10 18:25:56 (1 day ago)	Bruteforce WebAttack	Brute-Force Web App Attack
Anonymous	2026-07-10 16:32:41 (2 days ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇳🇱 wlt-blocker	2026-07-10 06:56:03 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
Anonymous	2026-07-10 06:24:19 (2 days ago)	85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /.git/HEAD HTTP/1.1" 404 432 "-" "Mozilla/5.0 (W ... show more 85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /.git/HEAD HTTP/1.1" 404 432 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" 85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /.git/HEAD HTTP/1.1" 404 238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" 85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /.env HTTP/1.1" 404 432 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /.env HTTP/1.1" 404 238 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /env HTTP/1.1" 404 432 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" 85.121.208.40 - - [10/Jul/2026:08:24:17 +0200] "GET /env HTTP/1.1" 404 238 "-" "Mozilla/5.0 (Windows NT 10.0; Win6 ... show less	Bad Web Bot Web App Attack
🇫🇷 LRob	2026-07-10 06:03:21 (2 days ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/.env","/.git/HEAD","/.git/config","/api/.env" ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/.env","/.git/HEAD","/.git/config","/api/.env","/.aws/credentials"] \| UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac show less	Hacking
🇷🇺 DZBOT	2026-07-10 03:41:42 (2 days ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇩🇪 maxpower	2026-07-10 03:05:58 (2 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 85.121.208.40 (RO/Romania/-): 1 in the l ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 85.121.208.40 (RO/Romania/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 85.121.208.40 - - [10/Jul/2026:05:05:53 +0200] "GET /.aws/credentials HTTP/1.1" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/146.0.3856.109" "-" host=mail.tikitakaplanet.it show less	Port Scan
🇨🇭 filou812	2026-07-10 02:39:17 (2 days ago)	url tried is "/.env.development"	Web App Attack
🇩🇪 maxpower	2026-07-10 02:37:44 (2 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 85.121.208.40 (RO/Romania/-): 1 in the l ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 85.121.208.40 (RO/Romania/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 85.121.208.40 - - [10/Jul/2026:04:37:40 +0200] "GET /.aws/credentials HTTP/1.1" 404 11791 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15" "-" host=mail.sensationart.it show less	Port Scan
🇩🇪 Roper123	2026-07-10 01:47:59 (2 days ago)	Web exploits	Web App Attack
🇬🇧 Aetherweb Ark	2026-07-10 01:40:10 (2 days ago)	(mod_security) mod_security (id:949110) triggered by 85.121.208.40 (RO/Romania/-): N in the last X s ... show more (mod_security) mod_security (id:949110) triggered by 85.121.208.40 (RO/Romania/-): N in the last X secs show less	Web App Attack
Anonymous	2026-07-10 01:28:16 (2 days ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇩🇪 Lino Project	2026-07-10 01:25:40 (2 days ago)	CrowdSec abuse IP report (host SRV-2) Scenario: crowdsecurity/http-sensitive-files	Hacking
Anonymous	2026-07-10 01:05:52 (2 days ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: RO, Attack patterns: Clou ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: RO, Attack patterns: Cloud secrets probing show less	Bad Web Bot Web App Attack
🇩🇪 XICTRON	2026-07-10 00:50:06 (2 days ago)	ModSecurity rule violation detected by Fail2Ban	Web App Attack

Showing 1 to 15 of 59 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇹 196.188.187.59

🇨🇦 142.44.149.52

🇨🇳 101.126.155.86

🇳🇱 195.178.110.217

🇳🇱 195.178.110.137

🇵🇱 195.3.220.7

🇷🇴 193.46.255.86

🇷🇴 193.29.13.64

🇧🇷 181.218.172.74

🇲🇽 177.228.193.33

🇺🇸 162.241.239.241

🇺🇸 162.241.132.172

🇺🇸 162.144.195.114

🇺🇸 158.51.126.144

🇺🇸 142.111.152.17

🇨🇳 113.214.64.27

🇰🇪 102.210.149.236

🇷🇺 85.172.170.162

🇺🇸 35.243.134.24

🇨🇦 20.48.236.161