AbuseIPDB » 85.203.15.95

85.203.15.95 was found in our database!

This IP was reported 182 times. Confidence of Abuse is 64%: ?

64%

ISP	Falco Networks B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS62240
Domain Name	falco-networks.com
Country	Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 85.203.15.95

Whois 85.203.15.95

IP Abuse Reports for 85.203.15.95:

This IP address has been reported a total of 182 times from 76 distinct sources. 85.203.15.95 was first reported on September 27th 2022, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rtbh.com.tr	2025-06-17 20:07:12 (3 days ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
rtbh.com.tr	2025-06-16 20:07:11 (4 days ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
ghostwarriors	2025-06-15 17:50:03 (5 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
Starburst SysOp Team	2025-06-15 16:51:17 (5 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-18)	Hacking Bad Web Bot
Coco Bongo	2025-06-14 07:46:54 (6 days ago)	85.203.15.95 [redacted] (62240-Clouvider Limited Germany Frankfurt am Main) - - [14/Jun/2025:09:46:4 ... show more85.203.15.95 [redacted] (62240-Clouvider Limited Germany Frankfurt am Main) - - [14/Jun/2025:09:46:41 +0200] "POST /.env.project%20 HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; ... show less	Bad Web Bot Web App Attack
alliance	2025-06-14 07:32:17 (6 days ago)	14.06.2025 07:30:55 Environment file scan (/.env)	Hacking Web App Attack
Penny Packer	2025-06-13 20:51:18 (6 days ago)	Fail2Ban apache-tripwires	Web App Attack
Linux-Tech	2025-06-13 16:56:29 (1 week ago)	85.203.15.95 - - [13/Jun/2025:18:56:02 +0200] "POST /.env.production HTTP/1.1" 400 154 "-" "Mozilla/ ... show more85.203.15.95 - - [13/Jun/2025:18:56:02 +0200] "POST /.env.production HTTP/1.1" 400 154 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" 85.203.15.95 - - [13/Jun/2025:18:56:29 +0200] "GET /cp/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" show less	Port Scan Bad Web Bot Web App Attack
ifiguero	2025-06-10 10:25:57 (1 week ago)	Web Attack (WordPress search). 30m ban	Web App Attack
TPI-Abuse	2025-06-09 11:39:50 (1 week ago)	(mod_security) mod_security (id:211540) triggered by 85.203.15.95 (-): 1 in the last 300 secs; Ports ... show more(mod_security) mod_security (id:211540) triggered by 85.203.15.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 09 07:39:42.314257 2025] [security2:error] [pid 2005866:tid 2005866] [client 85.203.15.95:7197] ModSecurity: Access denied with code 403 (phase 2). Match of "contains /wp-json/yoast/" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "17"] [id "211540"] [rev "14"] [msg "COMODO WAF: Blind SQL Injection Attack||www.powerkiteforum.com|F|2"] [data "Matched Data: waitfor delay found within REQUEST_URI: /today.php?daysold=1%20waitfor%20delay%20'0:0:15'%20--%20"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.powerkiteforum.com"] [uri "/today.php"] [unique_id "aEbH_njWfgWbwUBlTF-OAgAAAAU"], referer: https://www.powerkiteforum.com/ show less	Brute-Force Bad Web Bot Web App Attack
marzzzello	2025-06-04 02:24:08 (2 weeks ago)	Ports: 14x 24153	Port Scan
marzzzello	2025-05-31 23:04:23 (2 weeks ago)	Ports: 5x 33157	Port Scan
Anonymous	2025-05-29 19:00:15 (3 weeks ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
Anonymous	2025-05-27 22:12:13 (3 weeks ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
TPI-Abuse	2025-05-18 22:22:04 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 85.203.15.95 (-): 1 in the last 300 secs; Ports ... show more(mod_security) mod_security (id:210492) triggered by 85.203.15.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 18 18:21:57.567263 2025] [security2:error] [pid 2432188:tid 2432188] [client 85.203.15.95:11145] [client 85.203.15.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mapleleaf-marketing.com"] [uri "/restore/sftp-config.json"] [unique_id "aCpdhe7eOl0scFTDT1raOwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩