JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.203.44.42

85.203.44.42 was found in our database!

This IP was reported 68 times. Confidence of Abuse is 16%: ?

16%

ISP	Falco Networks B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS42708
Domain Name	falco-networks.com
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.203.44.42

Whois 85.203.44.42

IP Abuse Reports for 85.203.44.42:

This IP address has been reported a total of 68 times from 31 distinct sources. 85.203.44.42 was first reported on November 26th 2023, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 URAN Publishing Service	2026-08-24 17:03:22 (13 hours ago)	[24/Aug/2026:20:03:21 +0300] -- 85.203.44.42 Ban reason: User-Agent Go-http-client	Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-07-17 09:55:03 (1 month ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇭🇺 bcsaba	2026-07-07 21:33:53 (1 month ago)	Suricata: Alert - ET INFO Go-http-client User-Agent Observed Inbound	Web App Attack
🇫🇮 YF	2026-06-09 10:00:57 (2 months ago)	Attaque distribuée subnet	DDoS Attack Web App Attack
🇺🇦 URAN Publishing Service	2026-06-09 08:32:25 (2 months ago)	85.203.44.42 - - [09/Jun/2026:11:32:24 +0300] "GET /wp-includes/js/index.php HTTP/1.1" 404 706 "-" " ... show more 85.203.44.42 - - [09/Jun/2026:11:32:24 +0300] "GET /wp-includes/js/index.php HTTP/1.1" 404 706 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 OPR/70.0.3728.95" 85.203.44.42 - - [09/Jun/2026:11:32:24 +0300] "GET /wp-content/upgrade/item.php HTTP/1.1" 404 706 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" ... show less	Web App Attack
🇳🇱 ParaBug	2026-06-03 09:53:12 (2 months ago)	85.203.44.42 - - [03/Jun/2026:11:53:12 +0200] "GET /wp-login.php HTTP/1.1" 301 2926 "-" "Mozilla/5.0 ... show more 85.203.44.42 - - [03/Jun/2026:11:53:12 +0200] "GET /wp-login.php HTTP/1.1" 301 2926 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Vivaldi/6.7" ... show less	Phishing Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2026-05-18 17:46:49 (3 months ago)	85.203.44.42 - - [18/May/2026:20:46:46 +0300] "GET //administrator/index.php HTTP/1.1" 404 706 "-" " ... show more 85.203.44.42 - - [18/May/2026:20:46:46 +0300] "GET //administrator/index.php HTTP/1.1" 404 706 "-" "Go-http-client/1.1" 85.203.44.42 - - [18/May/2026:20:46:48 +0300] "GET //wp-content/plugins/age-restriction/modules/remote_support/remote_init.php HTTP/1.1" 404 706 "-" "Go-http-client/1.1" ... show less	Web App Attack
🇫🇷 masterguru	2026-04-20 17:38:40 (4 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-193) show less	Bad Web Bot
🇺🇸 mnsf	2026-01-30 17:05:37 (6 months ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-01-22 12:37:43 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.44.42 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 85.203.44.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 07:37:37.976936 2026] [security2:error] [pid 11249:tid 11249] [client 85.203.44.42:50657] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|headcount.dev\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "headcount.dev"] [uri "/old/backup.sql"] [unique_id "aXIaEdLBpI2RsSpEUUGHKQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-01-22 07:05:33 (7 months ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-12-23 20:33:29 (8 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.44.42 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 85.203.44.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 23 15:33:23.724063 2025] [security2:error] [pid 14226:tid 14226] [client 85.203.44.42:45005] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|qualityelevatorcabs.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "qualityelevatorcabs.com"] [uri "/backups/dump.sql"] [unique_id "aUr8kz8TYmhcQRVr_wNtiQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2025-12-20 20:28:39 (8 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-122) show less	Bad Web Bot
🇬🇧 pinguin	2025-12-01 10:08:08 (8 months ago)	Triggered Cloudflare WAF (firewallManaged) from SE. Action taken: LOG Protocol: HTTP/2 (HEAD method) ... show more Triggered Cloudflare WAF (firewallManaged) from SE. Action taken: LOG Protocol: HTTP/2 (HEAD method) Endpoint: /backup/backup.tar UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2025-11-19 17:05:59 (9 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.44.42 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 85.203.44.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 19 12:05:55.060763 2025] [security2:error] [pid 16957:tid 16957] [client 85.203.44.42:45509] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|loriatrading.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "loriatrading.com"] [uri "/bak/dump.sql"] [unique_id "aR348zCGF6c0FSv14r3oZAAAABo"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 68 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a940:301:225:0:15::

🇬🇧 185.216.145.172

🇺🇸 172.208.64.76

🇺🇸 143.198.147.65

🇺🇸 91.230.168.52

🇨🇦 85.217.149.60

🇺🇸 195.184.76.172

🇳🇱 195.178.110.217

🇬🇧 193.32.209.238

🇧🇷 177.188.219.161

🇩🇪 151.243.11.230

🇷🇺 109.237.233.195

🇮🇹 78.211.191.94

🇷🇺 45.91.64.6

🇨🇳 36.213.109.115

🇬🇧 35.203.211.168

🇬🇧 5.226.140.34

🇮🇹 190.106.186.5

🇺🇸 172.110.223.173

🇫🇷 172.69.222.26