JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

85.203.20.104

Activity Trending Down

Abuse Confidence Score

24% Elevated

123 reports

32 reporters · latest 1 week ago

ISP: Falco Networks B.V.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS212238
Domain Name: falco-networks.com
Country: 🇭🇷 Croatia
City: Zagreb, Zagreb

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

123 from 32 distinct reporters

First reported

February 27th 2023

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇩🇪 Germany 2 🇮🇹 Italy 1 🇵🇱 Poland 1

Most common categories Brute-Force 3 Web App Attack 2 Hacking 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-11-07 09:57:06 UTC · (1 week ago)	WEB attack	Brute-Force
🇮🇹 VHosting	2026-10-29 22:25:04 UTC · (2 weeks ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇩🇪 33three	2026-10-29 14:59:27 UTC · (2 weeks ago)	Fail2Ban jail WebAttack triggered	Brute-Force
Anonymous	2026-10-28 12:21:33 UTC · (2 weeks ago)	[ns41.kdns.gr] httpd-shell-path-probe: sites=www.jiotis.gr; logs=/var/log/httpd/domains/jiotis.gr.log; samples=/wp-content/plugins/buddypress/alfa.php	Hacking Web App Attack
🇨🇭 backslash	2026-09-01 23:33:00 UTC · (2 months ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-11 09:21:15 UTC · (8 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 05:21:07.592172 2026] [security2:error] [pid 31259:tid 31259] [client 85.203.20.104:0] ModSe ... show more (mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 05:21:07.592172 2026] [security2:error] [pid 31259:tid 31259] [client 85.203.20.104:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ccamp.dev\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ccamp.dev"] [uri "/backups/backup.sql"] [unique_id "abE0A_ZcYPH9tYCiffE5YgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Penny Packer	2026-03-01 10:25:32 UTC · (8 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇺🇸 TPI-Abuse	2026-02-23 11:13:31 UTC · (8 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 06:13:25.749397 2026] [security2:error] [pid 30990:tid 30990] [client 85.203.20.104:59003] M ... show more (mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 06:13:25.749397 2026] [security2:error] [pid 30990:tid 30990] [client 85.203.20.104:59003] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|doubloonswap.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "doubloonswap.com"] [uri "/backups/sql.sql"] [unique_id "aZw2Ve9D3Cm-Yc-uHrtVewAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 pinguin	2026-02-18 18:20:49 UTC · (8 months ago)	Triggered Cloudflare WAF (firewallManaged) from HR. Action taken: LOG Protocol: HTTP/1.1 (HEAD method) Endpoint: /restore/directory.tar.gz UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-11 04:19:04 UTC · (9 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 23:18:56.650959 2026] [security2:error] [pid 10161:tid 10161] [client 85.203.20.104:48371] M ... show more (mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 23:18:56.650959 2026] [security2:error] [pid 10161:tid 10161] [client 85.203.20.104:48371] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.nationalenq.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nationalenq.com"] [uri "/www.sql"] [unique_id "aYwDMBeD7-GZ0xKoGeRxdwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-02-08 05:38:54 UTC · (9 months ago)	Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [wa01]	Bad Web Bot Web App Attack
Anonymous	2026-02-07 12:56:42 UTC · (9 months ago)	wordpress-trap	Web App Attack
🇺🇸 TPI-Abuse	2026-02-06 17:47:31 UTC · (9 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 12:47:23.178962 2026] [security2:error] [pid 2682:tid 2682] [client 85.203.20.104:20973] Mod ... show more (mod_security) mod_security (id:210730) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 12:47:23.178962 2026] [security2:error] [pid 2682:tid 2682] [client 85.203.20.104:20973] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.domainexecs.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.domainexecs.com"] [uri "/backups/mysql.sql"] [unique_id "aYYpK9MVskho82tyhd-VbgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-05 20:06:56 UTC · (9 months ago)	(mod_security) mod_security (id:240000) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 15:06:50.295411 2026] [security2:error] [pid 32203:tid 32203] [client 85.203.20.104:45129] M ... show more (mod_security) mod_security (id:240000) triggered by 85.203.20.104 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 15:06:50.295411 2026] [security2:error] [pid 32203:tid 32203] [client 85.203.20.104:45129] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder\|\|www.limobusrichmond.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.limobusrichmond.com"] [uri "/images/stories/themes.php"] [unique_id "aYT4Wmtmi-8qzPw_UxCy-gAAADg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-05 15:06:40 UTC · (9 months ago)	[Thu Feb 05 15:06:39.118776 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:34987] AH01071: Got error 'Primary script unknown' [Thu Feb 05 15:06:39.234744 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:3 ... show more [Thu Feb 05 15:06:39.118776 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:34987] AH01071: Got error 'Primary script unknown' [Thu Feb 05 15:06:39.234744 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:34987] AH01071: Got error 'Primary script unknown' [Thu Feb 05 15:06:39.323736 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:34987] AH01071: Got error 'Primary script unknown' [Thu Feb 05 15:06:39.399039 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:34987] AH01071: Got error 'Primary script unknown' [Thu Feb 05 15:06:39.514776 2026] [proxy_fcgi:error] [pid 216160:tid 216160] [client 85.203.20.104:34987] AH01071: Got error 'Primary script unknown' ... show less	Hacking

Showing 1 to 15 of 123 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇷 210.206.95.162

🇳🇱 200.138.46.89

🇹🇳 154.110.5.100

🇮🇳 117.192.212.189

🇳🇱 35.214.240.93

🇳🇱 35.214.235.207

🇧🇪 35.195.245.38

🇧🇪 35.187.119.212

🇳🇱 34.1.224.69

🇳🇱 213.209.159.26

🇺🇦 194.44.122.6

🇧🇷 192.141.242.5

🇲🇾 161.142.151.233

🇮🇳 150.230.235.154

🇵🇰 139.135.53.188

🇧🇩 123.253.3.184

🇸🇬 94.231.206.15

🇩🇪 45.135.194.127

🇺🇸 45.131.195.219

🇹🇼 34.80.218.216