JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.128.143.125

85.128.143.125 was found in our database!

This IP was reported 87 times. Confidence of Abuse is 47%: ?

47%

ISP	webhosting servers
Usage Type	Data Center/Web Hosting/Transit
ASN	AS15967
Hostname(s)	static-akl125.rev.netart.com
Domain Name	netart.com
Country	🇵🇱 Poland
City	Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.128.143.125

Whois 85.128.143.125

IP Abuse Reports for 85.128.143.125:

This IP address has been reported a total of 87 times from 47 distinct sources. 85.128.143.125 was first reported on December 16th 2021, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-07-11 00:24:55 (2 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 Mundo Bueno	2026-07-11 00:16:32 (2 days ago)	[ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: PL \| UA: Mozilla/5.0 (Windows NT 10. ... show more [ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: PL \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Sa show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 18:39:24 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 85.128.143.125 (static-akl125.rev.netart.com): ... show more (mod_security) mod_security (id:225170) triggered by 85.128.143.125 (static-akl125.rev.netart.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 14:39:19.827855 2026] [security2:error] [pid 21681:tid 21681] [client 85.128.143.125:37910] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|orcastrong.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "orcastrong.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "alE8V8SSNMUGeCJul7onFwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 spamverify.com	2026-07-10 07:21:15 (3 days ago)	Honeypot Hit: WordPress Users	Web Spam Blog Spam Bad Web Bot Web App Attack
🇩🇪 Hazzard	2026-07-10 03:00:38 (3 days ago)	(wordpress) Failed wordpress login from 85.128.143.125 (PL/Poland/-/-/static-akl125.rev.netart.com/[ ... show more (wordpress) Failed wordpress login from 85.128.143.125 (PL/Poland/-/-/static-akl125.rev.netart.com/[redacted]): (CF_ENABLE) show less	Brute-Force
🇨🇿 ptlab	2026-07-09 22:45:25 (3 days ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-07-09 21:53:53 (3 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 lostswordfish.com	2026-07-09 18:48:03 (3 days ago)	Wordfence waf block on madesimpleskincare	Web App Attack
🇮🇹 VHosting	2026-05-26 07:42:12 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇦🇺 weblite	2025-12-22 06:44:38 (6 months ago)	WP_LOGIN_FAIL WP_XMLRPC_ABUSE	Brute-Force Web App Attack
🇺🇸 mnsf	2025-12-21 09:05:36 (6 months ago)	Login Too Frequent (7)	Brute-Force Web App Attack
Anonymous	2024-03-20 12:00:40 (2 years ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇩🇪 Hazzard	2024-02-21 08:14:57 (2 years ago)	85.128.143.125 (PL/Poland/-/-/static-akl125.rev.netart.com/[redacted]), more than 3 Apache 403 hits	Hacking
🇺🇸 TPI-Abuse	2024-02-21 06:06:49 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 85.128.143.125 (static-akl125.rev.netart.com): ... show more (mod_security) mod_security (id:210730) triggered by 85.128.143.125 (static-akl125.rev.netart.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 21 01:06:43.386397 2024] [security2:error] [pid 11975:tid 47955372234496] [client 85.128.143.125:37232] [client 85.128.143.125] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|travelusa.us\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "travelusa.us"] [uri "/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/rules.key"] [unique_id "ZdWS810jnMXqyBv-zdGcfQAAAMY"], referer: travelusa.us show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-02-21 04:30:12 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 85.128.143.125 (static-akl125.rev.netart.com): ... show more (mod_security) mod_security (id:210730) triggered by 85.128.143.125 (static-akl125.rev.netart.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 20 23:30:06.760708 2024] [security2:error] [pid 26398] [client 85.128.143.125:45594] [client 85.128.143.125] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|techfusion-inc.com\|F\|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "techfusion-inc.com"] [uri "/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/rules.key"] [unique_id "ZdV8TsKL3whYsYrOW2Y2ywAAAAI"], referer: techfusion-inc.com show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 87 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 151.243.11.231

🇩🇪 69.5.169.56

🇬🇧 185.247.137.3

🇺🇸 165.154.172.56

🇫🇷 161.97.119.248

🇺🇸 143.42.1.53

🇷🇺 109.63.143.156

🇺🇸 107.22.152.216

🇮🇳 103.218.237.243

🇨🇳 222.140.196.50

🇸🇬 217.15.161.119

🇹🇭 183.88.220.113

🇹🇭 182.53.176.63

🇺🇸 161.35.110.126

🇨🇳 111.17.199.57

🇩🇪 69.5.169.112

🇩🇪 69.5.169.51

🇩🇪 69.5.169.33

🇩🇪 69.5.169.3

🇺🇸 66.132.186.243