JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.195.233.39

85.195.233.39 was found in our database!

This IP was reported 73 times. Confidence of Abuse is 14%: ?

14%

ISP	Bern (640WEH)
Usage Type	Fixed Line ISP
ASN	AS13030
Hostname(s)	85-195-233-39.fiber7.init7.net
Domain Name	init7.net
Country	🇨🇭 Switzerland
City	Bern, Bern

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.195.233.39

Whois 85.195.233.39

IP Abuse Reports for 85.195.233.39:

This IP address has been reported a total of 73 times from 12 distinct sources. 85.195.233.39 was first reported on August 7th 2022, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 st-secure-team	2026-06-26 18:28:00 (6 days ago)	Constant access to servers requesting malicious files related to the Mirai family.	Exploited Host
Anonymous	2026-06-14 22:49:00 (2 weeks ago)	HONEYPOT HIT: 85.195.233.39: Unauthorised ping, connection and download attempts. Bruteforce attack ... show more HONEYPOT HIT: 85.195.233.39: Unauthorised ping, connection and download attempts. Bruteforce attack on port 22,2022,80,8080,8000,8443,81,82. Ip is also suspected of being part of a botnet. The ip is also suspected to be a urlhaus ip. show less	DDoS Attack Web Spam Port Scan Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted Hacking
🇳🇱 lentawaf	2026-05-29 15:45:00 (1 month ago)	УЧАСТНИК БОТНЕТА!	DDoS Attack Port Scan Brute-Force Bad Web Bot Exploited Host Web App Attack IoT Targeted Hacking
🇳🇱 ChanOrorspuEvladı	2025-12-08 18:22:56 (6 months ago)	Honeypot detected port_scan on port 80. IP: 85.195.233.39, Evidence: Port scan/exploit on port 80	Port Scan
🇳🇱 ChanOrorspuEvladı	2025-12-08 17:49:20 (6 months ago)	Honeypot Alert - Port 80 scan/attack attempt. Timestamp: 2025-12-08 17:49:20.209732. Connection deta ... show more Honeypot Alert - Port 80 scan/attack attempt. Timestamp: 2025-12-08 17:49:20.209732. Connection details: Port 80 honeypot connection - 2025-12-08 17:49:20 show less	Web App Attack
Anonymous	2025-08-05 18:28:44 (10 months ago)	wordpress-trap	Web App Attack
🇨🇳 ThreatBook.io	2025-07-15 23:01:27 (11 months ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025- ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025-07-15 01:13:19 /02.08.2022.exe show less	Web App Attack
🇺🇸 TPI-Abuse	2025-07-15 02:13:46 (11 months ago)	(mod_security) mod_security (id:210730) triggered by 85.195.233.39 (85-195-233-39.fiber7.init7.net): ... show more (mod_security) mod_security (id:210730) triggered by 85.195.233.39 (85-195-233-39.fiber7.init7.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 14 22:13:42.781885 2025] [security2:error] [pid 10673:tid 10673] [client 85.195.233.39:57678] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|pa-ksa.com\|F\|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pa-ksa.com"] [uri "/docs/Dxmnp.dll"] [unique_id "aHW5VgmQDyuDYEhXomGzcQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-07-14 23:12:22 (11 months ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025- ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025-07-14 01:04:26 /02.08.2022.exe show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-23 23:06:41 (1 year ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025- ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025-06-23 00:42:54 /02.08.2022.exe show less	Web App Attack
🇳🇱 Mangelot Hosting	2025-06-19 14:18:40 (1 year ago)	(bad_user_agent) srv201 Bad User-Agent 85.195.233.39 (CH/Switzerland/85-195-233-39.fiber7.init7.net) ... show more (bad_user_agent) srv201 Bad User-Agent 85.195.233.39 (CH/Switzerland/85-195-233-39.fiber7.init7.net): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇳🇱 Mangelot Hosting	2025-06-14 11:46:31 (1 year ago)	(bad_user_agent) srv201 Bad User-Agent 85.195.233.39 (CH/Switzerland/85-195-233-39.fiber7.init7.net) ... show more (bad_user_agent) srv201 Bad User-Agent 85.195.233.39 (CH/Switzerland/85-195-233-39.fiber7.init7.net): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-07 22:54:16 (1 year ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025- ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/85.195.233.39 2025-06-07 20:22:46 /02.08.2022.exe show less	Web App Attack
🇩🇪 bescared	2025-05-08 17:10:00 (1 year ago)		Bad Web Bot
🇺🇸 TPI-Abuse	2025-04-27 21:48:03 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 85.195.233.39 (85-195-233-39.fiber7.init7.net): ... show more (mod_security) mod_security (id:210730) triggered by 85.195.233.39 (85-195-233-39.fiber7.init7.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 27 17:47:59.056349 2025] [security2:error] [pid 16692:tid 16692] [client 85.195.233.39:39600] [client 85.195.233.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|pa-ksa.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pa-ksa.com"] [uri "/docs/Inyxrm.dat"] [unique_id "aA6mD0_gFrJbiEZxxS8_nAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 73 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 114.10.47.235

🇺🇸 97.165.166.26

🇦🇪 86.97.243.182

🇧🇷 191.240.224.208

🇳🇱 45.153.34.165

🇫🇮 45.133.113.126

🇺🇸 35.130.111.98

🇸🇪 31.134.14.186

🇯🇵 8.216.8.34

🇺🇸 216.25.89.155

🇵🇰 210.56.12.205

🇺🇸 205.210.31.82

🇩🇪 185.242.3.195

🇬🇧 185.216.145.163

🇵🇪 181.67.122.203

🇵🇱 176.53.159.197

🇺🇸 165.154.206.151

🇳🇱 45.148.10.152

🇯🇵 43.165.170.198

🇺🇸 155.94.145.131