JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.121.245.189

85.121.245.189 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 44%: ?

44%

ISP	Urban Network Solutions SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	urbannetworksolutions.nl
Country	🇷🇴 Romania
City	Bucharest, Bucharest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.121.245.189

Whois 85.121.245.189

IP Abuse Reports for 85.121.245.189:

This IP address has been reported a total of 9 times from 7 distinct sources. 85.121.245.189 was first reported on June 12th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-12 21:59:27 (2 days ago)	Auto-ban: >3000 req/min op 2026-06-12	Web App Attack SSH Hacking
Anonymous	2026-06-12 16:48:04 (2 days ago)	Bot / scanning and/or hacking attempts: GET /.env.production HTTP/2.0, GET /api/.env HTTP/2.0, GET / ... show more Bot / scanning and/or hacking attempts: GET /.env.production HTTP/2.0, GET /api/.env HTTP/2.0, GET /.env.staging HTTP/2.0, GET /google.json HTTP/2.0, GET /serviceAccountKey.json HTTP/2.0, GET /public/.env HTTP/2.0, GET /.env.bak HTTP/2.0, GET /config.env HTTP/2.0, GET /config/secrets.yml HTTP/2.0, GET /.env.test HTTP/2.0, GET /.aws/credentials HTTP/2.0, GET /application.properties HTTP/2.0, GET /app/.env HTTP/2.0, GET /credentials.json HTTP/2.0, GET /google-credentials.json HTTP/2.0, GET /settings.py HTTP/2.0, GET /admin/.env HTTP/2.0, GET /service-account.json HTTP/2.0, GET /.env.local HTTP/2.0, GET /application.yml HTTP/2.0, GET /.env.backup HTTP/2.0 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 16:28:33 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 85.121.245.189 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.245.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 12:28:27.955488 2026] [security2:error] [pid 17903:tid 17903] [client 85.121.245.189:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cloudex.click"] [uri "/api/.env"] [unique_id "aiwzq_aGE9r-c_60sL3k_gAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 16:12:20 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 85.121.245.189 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.245.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 12:12:13.931783 2026] [security2:error] [pid 6791:tid 6806] [client 85.121.245.189:37330] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pacific-biologics.fevini.com"] [uri "/.env"] [unique_id "aiwv3f6tpiZYTiDekSmmfgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 15:56:17 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 85.121.245.189 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 85.121.245.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 11:56:14.161009 2026] [security2:error] [pid 11337:tid 11337] [client 85.121.245.189:58408] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gormish.org"] [uri "/.env"] [unique_id "aiwsHgv4CNJIc07-vncgoAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-12 11:41:10 (2 days ago)	Multiple WAF Violations	Web App Attack
🇩🇪 dsp	2026-06-12 10:53:46 (2 days ago)	Firewall (ufw): port scanning on [80]	Port Scan
🇺🇸 sandra361	2026-06-12 09:56:43 (2 days ago)	Port scan detected: 5 attempts across 2 ports (443,80). \| Evidence: GHOST_SCAN: IN=enp1s0 SRC=85.121 ... show more Port scan detected: 5 attempts across 2 ports (443,80). \| Evidence: GHOST_SCAN: IN=enp1s0 SRC=85.121.245.189 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=413 DF PROTO=TCP SPT=56820 DPT=443 WINDOW=32120 RES=0x00 SYN URGP=0 show less	Port Scan
🇩🇪 David Ferneding	2026-06-12 09:20:42 (2 days ago)	Blocked by UFW (TCP on 80) Source port: 43954 TTL: 55 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 43954 TTL: 55 Packet length: 60 TOS: 0x00 This report (for 85.121.245.189) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 172.253.83.221

🇩🇪 64.89.163.140

🇨🇳 119.147.8.82

🇨🇳 116.179.32.73

🇻🇳 113.160.101.136

🇷🇺 90.150.172.17

🇫🇷 85.217.140.42

🇵🇰 59.103.112.31

🇨🇳 43.248.108.3

🇮🇩 43.133.148.170

🇺🇸 34.55.190.186

🇹🇼 2404:6800:4008:c05::12b

🇨🇳 220.180.170.126

🇨🇱 201.186.40.161

🇩🇪 128.1.34.69

🇺🇸 64.62.156.171

🇨🇦 51.222.168.22

🇮🇳 49.42.123.63

🇺🇸 20.236.100.6

🇩🇪 213.209.159.11