JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.192.49.141

85.192.49.141 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 83%: ?

83%

ISP	H2.NEXUS Helsinki Network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS215730
Hostname(s)	aeza.iloveyou
Domain Name	h2.nexus
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.192.49.141

Whois 85.192.49.141

IP Abuse Reports for 85.192.49.141:

This IP address has been reported a total of 28 times from 18 distinct sources. 85.192.49.141 was first reported on March 9th 2026, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-01 13:14:11 (10 hours ago)	(mod_security) mod_security (id:210730) triggered by 85.192.49.141 (aeza.iloveyou): 1 in the last 30 ... show more (mod_security) mod_security (id:210730) triggered by 85.192.49.141 (aeza.iloveyou): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:14:04.225535 2026] [security2:error] [pid 12487:tid 12487] [client 85.192.49.141:30722] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|dailybeautysupply.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dailybeautysupply.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apbPnAVCwWZlEUW1y-oO9gAAAAE"], referer: https://dailybeautysupply.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-09-01 08:54:27 (14 hours ago)	lae-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-09-01 08:35:55 (14 hours ago)	vee-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-09-01 07:40:35 (15 hours ago)	ave-Joomla Admin : try to force the door...	Hacking
🇳🇱 Savvii	2026-09-01 06:55:20 (16 hours ago)	20 attempts against mh-misbehave-ban on milky	Brute-Force Bad Web Bot Web App Attack
🇩🇪 23p02732	2026-08-31 09:22:44 (1 day ago)	Automated web scanning and malicious probing	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Aetherweb Ark	2026-08-31 08:32:01 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 85.192.49.141 (FI/Finland/aeza.iloveyou): N in ... show more (mod_security) mod_security (id:949110) triggered by 85.192.49.141 (FI/Finland/aeza.iloveyou): N in the last X secs show less	Web App Attack
🇫🇷 LRob	2026-08-31 08:28:04 (1 day ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /wp-content/plugins/wpmudev-updates/changelog.txt \| 2026-08-31 08:28 UTC show less	Hacking Web App Attack
🇩🇪 4server	2026-08-31 06:11:41 (1 day ago)	[MonAug3108:11:36.7563002026][security2:error][pid2286748:tid2286887][client85.192.49.141:0]ModSecur ... show more [MonAug3108:11:36.7563002026][security2:error][pid2286748:tid2286887][client85.192.49.141:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"serban.ch\"][uri\"/media/com_fabrik/js/list-actions.js\"][unique_id\"apUbGPwUYO_tQBoJyt5WnQAAARM\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 04:40:05 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 85.192.49.141 (aeza.iloveyou): 1 in the last 30 ... show more (mod_security) mod_security (id:210730) triggered by 85.192.49.141 (aeza.iloveyou): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 00:39:56.325869 2026] [security2:error] [pid 11167:tid 11167] [client 85.192.49.141:30116] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|lynnsmetkodesigns.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lynnsmetkodesigns.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apUFnJwYm2XtDTzuyjDfPgAAAAo"], referer: https://lynnsmetkodesigns.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-30 21:04:48 (2 days ago)	☣️ WAF rule violation. Dangerous payload detected in the request.	Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-08-30 20:05:46 (2 days ago)	[redacted] 85.192.49.141 - - [30/Aug/2026:21:05:44 +0100] "GET /.env HTTP/1.1" 302 6778 0/42575 "-" ... show more [redacted] 85.192.49.141 - - [30/Aug/2026:21:05:44 +0100] "GET /.env HTTP/1.1" 302 6778 0/42575 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2664.8 Safari/537.36" [redacted] 85.192.49.141 - - [30/Aug/2026:21:05:45 +0100] "GET /[redacted] HTTP/1.1" 302 6778 0/45171 "https://[redacted]/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2664.8 Safari/537.36" show less	Bad Web Bot Web App Attack
Anonymous	2026-08-30 19:18:16 (2 days ago)	apache vulnerability scan	Web App Attack
🇨🇭 4server	2026-08-30 18:38:03 (2 days ago)	[SunAug3020:37:56.8122642026][security2:error][pid3472452:tid3472720][client85.192.49.141:0]ModSecur ... show more [SunAug3020:37:56.8122642026][security2:error][pid3472452:tid3472720][client85.192.49.141:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"rs-solution.ch\"][uri\"/media/com_fabrik/js/list-actions.js\"][unique_id\"apR4hCDKupzz8zAPVFaurwAAAZQ\"] show less	Hacking Web App Attack
🇩🇪 LRob	2026-08-30 17:52:20 (2 days ago)	PHP code injection in the query string (webshell drop or RCE attempt) \| method: GET \| path: /spip.ph ... show more PHP code injection in the query string (webshell drop or RCE attempt) \| method: GET \| path: /spip.php \| query: a=%3C%3Fphp+header%28%21X-Spip-Filtre%3A+filtrer_entites%21%29+%3F%3E&b=%3F%3E%26%2339%3B.file_put_contents%28%26%2334%3B83b299d \| 2026-08-30 17:52 UTC show less	Hacking Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 134.209.124.234

🇵🇱 94.26.68.208

🇮🇶 65.20.205.197

🇶🇦 34.18.45.26

🇨🇳 218.25.89.208

🇹🇼 211.72.174.198

🇵🇭 180.193.181.195

🇳🇬 165.154.11.140

🇸🇬 134.209.103.135

🇷🇴 80.94.92.144

🇬🇧 68.183.47.88

🇺🇸 66.132.195.91

🇲🇾 49.124.152.228

🇸🇬 35.197.135.158

🇨🇳 27.24.141.111

🇰🇷 14.39.107.91

🇺🇸 172.86.114.169

🇨🇳 114.80.39.74

🇸🇬 104.28.222.46

🇺🇸 76.230.157.214