JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.131.197.38

85.131.197.38 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 0%: ?

ISP	XServer Cloud Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS131965
Hostname(s)	sv16097.xserver.jp
Domain Name	xserver.ne.jp
Country	🇯🇵 Japan
City	Osaka, Osaka

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.131.197.38

Whois 85.131.197.38

IP Abuse Reports for 85.131.197.38:

This IP address has been reported a total of 37 times from 32 distinct sources. 85.131.197.38 was first reported on April 27th 2026, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 Peter-Johann Sarbach	2026-04-29 04:21:08 (4 months ago)	Hacking website	Hacking
🇫🇮 KnightIndustries	2026-04-28 07:07:08 (4 months ago)	2026-04-28T08:17:40.971317+02:00 milkyway wordpress(learncryptography.pw)[1607850]: Authentication a ... show more 2026-04-28T08:17:40.971317+02:00 milkyway wordpress(learncryptography.pw)[1607850]: Authentication attempt for unknown user thespacebutt from 85.131.197.38 2026-04-28T08:43:48.698958+02:00 milkyway wordpress(learncryptography.pw)[1607850]: Authentication attempt for unknown user MysticKnightUK from 85.131.197.38 2026-04-28T09:07:07.996827+02:00 milkyway wordpress(fawcettcomputerservices.com)[1634833]: Authentication failure for joshua from 85.131.197.38 ... show less	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-04-28 07:05:04 (4 months ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-04-28 07:03:04 (4 months ago)	Bot / scanning and/or hacking attempts: GET /wp-login.php HTTP/2.0, [2/2] done, POST /wp-login.php H ... show more Bot / scanning and/or hacking attempts: GET /wp-login.php HTTP/2.0, [2/2] done, POST /wp-login.php HTTP/2.0 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-28 06:38:35 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 85.131.197.38 (sv16097.xserver.jp): 1 in the la ... show more (mod_security) mod_security (id:225170) triggered by 85.131.197.38 (sv16097.xserver.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 02:38:29.960492 2026] [security2:error] [pid 23307:tid 23307] [client 85.131.197.38:55044] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tedharris.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tedharris.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afBV5cUOYZaPAPTuwEOhvAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Roderic	2026-04-28 06:34:13 (4 months ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted])	Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-28 06:14:16 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 85.131.197.38 (sv16097.xserver.jp): 1 in the la ... show more (mod_security) mod_security (id:225170) triggered by 85.131.197.38 (sv16097.xserver.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 02:14:11.091271 2026] [security2:error] [pid 13597:tid 13597] [client 85.131.197.38:35010] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|nwtree.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nwtree.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afBQM0muy401523jyLf_PQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-28 05:49:46 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 85.131.197.38 (sv16097.xserver.jp): 1 in the la ... show more (mod_security) mod_security (id:225170) triggered by 85.131.197.38 (sv16097.xserver.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 01:49:40.931100 2026] [security2:error] [pid 29555:tid 29555] [client 85.131.197.38:36782] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|stop902.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stop902.org"] [uri "/wp-json/wp/v2/users"] [unique_id "afBKdLWy3ZaSMLLSOfIQqgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-28 05:45:04 (4 months ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot
🇺🇸 mind5t0rm	2026-04-28 05:33:36 (4 months ago)	(WPLOGIN) WP Login Attack 85.131.197.38 (JP/Japan/sv16097.xserver.jp): 3 in the last 3600 secs; Port ... show more (WPLOGIN) WP Login Attack 85.131.197.38 (JP/Japan/sv16097.xserver.jp): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 85.131.197.38 - - [28/Apr/2026:12:32:17 +0700] "GET /wp-login.php HTTP/2.0" 200 2311 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/7.0; .NET4.0C; .NET4.0E)" 85.131.197.38 - - [28/Apr/2026:12:32:20 +0700] "POST /wp-login.php HTTP/2.0" 200 2468 "https://tanitestates.com/wp-login.php" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/7.0; .NET4.0C; .NET4.0E)" 85.131.197.38 - - [28/Apr/2026:12:33:32 +0700] "GET /wp-login.php HTTP/2.0" 200 3123 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36" show less	Port Scan
🇳🇱 juutis	2026-04-28 05:11:27 (4 months ago)	85.131.197.38 - - [27/Apr/2026:21:06:54 +0200] "POST /wp-login.php HTTP/1.0" 200 7800 "https://taide ... show more 85.131.197.38 - - [27/Apr/2026:21:06:54 +0200] "POST /wp-login.php HTTP/1.0" 200 7800 "https://taidesuunnistus.net/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36" 85.131.197.38 - - [27/Apr/2026:22:52:34 +0200] "POST /wp-login.php HTTP/1.0" 200 7820 "https://taidesuunnistus.net/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; LCJB; rv:11.0) like Gecko" 85.131.197.38 - - [28/Apr/2026:07:11:26 +0200] "POST /wp-login.php HTTP/1.0" 200 7801 "https://taidesuunnistus.net/wp-login.php" "Mozilla/5.0 (IE 11.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; rv:11.0) like Gecko" show less	Web App Attack
🇺🇸 octageeks.com	2026-04-28 04:09:05 (4 months ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇩🇪 Click-Networks	2026-04-28 02:08:38 (4 months ago)		Web Spam Brute-Force Exploited Host
🇩🇪 Marc	2026-04-28 02:00:34 (4 months ago)		Brute-Force
🇫🇷 solution.it	2026-04-28 01:59:33 (4 months ago)	[Tue Apr 28 03:59:33.311987 2026] [php7:error] [pid 3206717:tid 3206717] [client 85.131.197.38:38554 ... show more [Tue Apr 28 03:59:33.311987 2026] [php7:error] [pid 3206717:tid 3206717] [client 85.131.197.38:38554] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat show less	Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 186.104.250.219

🇺🇸 161.38.201.13

🇳🇱 77.239.124.202

🇺🇸 73.106.13.248

🇩🇪 51.89.38.139

🇺🇸 170.244.94.208

🇻🇳 124.158.13.4

🇵🇱 94.26.68.54

🇨🇦 85.217.149.73

🇰🇼 37.34.138.115

🇺🇸 35.194.13.58

🇺🇸 18.144.84.29

🇺🇸 8.234.134.147

🇷🇴 2.57.122.168

🇹🇼 220.133.95.63

🇨🇳 202.107.164.50

🇦🇷 200.59.89.202

🇺🇸 192.81.229.181

🇨🇳 121.11.235.15

🇫🇷 91.196.152.96