JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.203.47.234

85.203.47.234 was found in our database!

This IP was reported 88 times. Confidence of Abuse is 23%: ?

23%

ISP	Falco Networks B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS42708
Domain Name	falco-networks.com
Country	🇩🇰 Denmark
City	Copenhagen, Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.203.47.234

Whois 85.203.47.234

IP Abuse Reports for 85.203.47.234:

This IP address has been reported a total of 88 times from 34 distinct sources. 85.203.47.234 was first reported on August 2nd 2023, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mw	2026-06-05 01:20:03 (10 hours ago)	GET /wp-admin/images/wp-conflg.php HTTP/1.1	Web App Attack
🇧🇷 Peregrine	2026-06-04 21:30:47 (14 hours ago)	Fail2Ban S3 Jail: tomcat-honeypot \| Evidence: - 85.203.47.234 - - [04/Jun/2026:18:30:36 -0300] "GET ... show more Fail2Ban S3 Jail: tomcat-honeypot \| Evidence: - 85.203.47.234 - - [04/Jun/2026:18:30:36 -0300] "GET /wp-admin/maint/ HTTP/1.1" 404 414 - 85.203.47.234 - - [04/Jun/2026:18:30:37 -0300] "GET /wp-admin/images/ HTTP/1.1" 404 414 - 85.203.47.234 - - [04/Jun/2026:18:30:38 -0300] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 404 414 - 85.203.47.234 - - [04/Jun/2026:18:30:43 -0300] "GET /wp-admin/js/ HTTP/1.1" 404 414 - 85.203.47.234 - - [04/Jun/2026:18:30:43 -0300] "GET /wp-admin/network/ HTTP/1.1" 404 414 - 85.203.47.234 - - [04/Jun/2026:18:30:43 -0300] "GET /wp-admin/ HTTP/1.1" 404 414 show less	Bad Web Bot
🇫🇷 Octopuce	2026-04-27 16:00:44 (1 month ago)	Aggressive web search of vulnerable pages: /wp-zx.php /gifclass.php /gfd.php /wp-temp.php /Okxob.php ... show more Aggressive web search of vulnerable pages: /wp-zx.php /gifclass.php /gfd.php /wp-temp.php /Okxob.php /x123x.php /aaa.php /options-head.php /rit ... show less	Web App Attack
🇬🇧 consul.to	2026-04-21 20:27:09 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 DocNetzwerk	2026-04-04 02:53:26 (2 months ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 85.203.47.234 (DK/Denmar ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 85.203.47.234 (DK/Denmark/-) show less	Port Scan
🇫🇷 Octopuce	2026-04-03 23:41:48 (2 months ago)	Aggressive web search of vulnerable pages: /wp-content/plugins/core-plugin/include.php /mah/function ... show more Aggressive web search of vulnerable pages: /wp-content/plugins/core-plugin/include.php /mah/function.php /info.php /log.php /wso.php /wp-conten ... show less	Web App Attack
🇺🇸 Penny Packer	2026-03-18 01:12:24 (2 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇧🇪 cmbplf	2026-03-10 10:53:40 (2 months ago)	251 requests with url.path /.well-known/pki-validation/.php 221 requests with url.path /.well-k ... show more 251 requests with url.path /.well-known/pki-validation/.php 221 requests with url.path /.well-known/acme-challenge/*.php show less	Brute-Force Bad Web Bot
🇺🇸 mnsf	2026-03-09 05:05:16 (2 months ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇪🇸 masterguru	2026-03-09 00:57:11 (2 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-122) show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-01 18:25:29 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.47.234 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 85.203.47.234 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 01 13:25:14.633916 2026] [security2:error] [pid 2810:tid 2810] [client 85.203.47.234:29537] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mindtoken.app\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mindtoken.app"] [uri "/backup.sql"] [unique_id "aaSEinYKgAMaY7FffJECYAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇾 armandosaucedo.me	2026-02-28 13:12:28 (3 months ago)	85.203.47.234 - - [28/Feb/2026:13:12:16 +0000] "GET /old/directory.zip HTTP/1.1" 404 196 "-" "-"	Web App Attack
🇺🇸 TPI-Abuse	2026-02-25 17:00:13 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 85.203.47.234 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 85.203.47.234 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 11:59:51.464943 2026] [security2:error] [pid 2942:tid 2942] [client 85.203.47.234:36065] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cryptofructo.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cryptofructo.com"] [uri "/restore/sql.sql"] [unique_id "aZ8qhzvn-1sHlp8Ud5gyJAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-02-23 03:26:05 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 rh24	2026-02-22 21:25:49 (3 months ago)	(mod_security) mod_security triggered on hostname [redacted] 85.203.47.234 (DK/Denmark/-): (CF_ENAB ... show more (mod_security) mod_security triggered on hostname [redacted] 85.203.47.234 (DK/Denmark/-): (CF_ENABLE) show less	SQL Injection

Showing 1 to 15 of 88 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 161.35.113.47

🇯🇵 133.18.180.27

🇩🇪 80.91.79.223

🇺🇸 65.49.1.186

🇱🇹 62.60.130.251

🇧🇷 45.205.1.71

🇳🇱 45.198.224.134

🇲🇽 187.190.35.163

🇨🇳 106.117.110.251

🇭🇰 103.43.8.71

🇬🇭 102.221.29.110

🇩🇪 69.5.169.188

🇺🇸 66.132.186.223

🇸🇬 8.222.129.223

🇮🇳 2401:4900:d807:d296:941f:8382:3af9:ab20

🇩🇪 192.109.200.78

🇸🇬 161.118.218.103

🇮🇳 139.59.75.85

🇳🇱 104.249.35.102

🇮🇳 49.43.1.223