JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.204.107.162

85.204.107.162 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 31%: ?

31%

ISP	INTERKVM HOST SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS25198
Domain Name	zetservers.com
Country	🇷🇴 Romania
City	Bucharest, Bucharest

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.204.107.162

Whois 85.204.107.162

IP Abuse Reports for 85.204.107.162:

This IP address has been reported a total of 16 times from 12 distinct sources. 85.204.107.162 was first reported on August 20th 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 Doruk	2026-09-25 23:00:01 (3 weeks ago)	Unauthorized connection attempt	Brute-Force
🇺🇸 Cherryh4ck	2026-09-20 15:42:58 (1 month ago)	Blocked by UFW [25565/tcp] \| SPT: 60506 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/se ... show more Blocked by UFW [25565/tcp] \| SPT: 60506 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇷 claude CALVET	2026-09-18 06:16:31 (1 month ago)	gee-7 : Trying access unauthorized files/dir=>/tmp/855855.phtm	Hacking
🇳🇱 Savvii	2026-09-18 04:55:34 (1 month ago)	20 attempts against mh_ha-misbehave-ban on sedna	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-18 04:05:41 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 85.204.107.162 (cloud.93.114.194.162.ez-hosts.x ... show more (mod_security) mod_security (id:210730) triggered by 85.204.107.162 (cloud.93.114.194.162.ez-hosts.xyz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 00:05:36.493840 2026] [security2:error] [pid 394:tid 394] [client 85.204.107.162:39816] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|kathiepontinen.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kathiepontinen.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "aqy4kGo_Ji2pKuQ9RYfjUgAAAAQ"], referer: https://kathiepontinen.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-09-17 20:48:55 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 11:27:24 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 85.204.107.162 (cloud.93.114.194.162.ez-hosts.x ... show more (mod_security) mod_security (id:210730) triggered by 85.204.107.162 (cloud.93.114.194.162.ez-hosts.xyz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 07:27:19.713498 2026] [security2:error] [pid 29817:tid 29817] [client 85.204.107.162:34586] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bigskyprints.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bigskyprints.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "aqvOl6yCRqLEBOEYhjKShwAAABA"], referer: https://bigskyprints.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-09-17 11:16:18 (1 month ago)	[ThuSep1713:16:14.5977272026][security2:error][pid145964:tid146092][client85.204.107.162:0]ModSecuri ... show more [ThuSep1713:16:14.5977272026][security2:error][pid145964:tid146092][client85.204.107.162:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"635\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"benvenutialfood.biz\"][uri\"/wp-content/plugins/wpmudev-updates/changelog.txt\"][unique_id\"aqvL_j6N2cY4_95_B5f9ngAAAVg\"] show less	Hacking Web App Attack
🇷🇺 e⁻	2026-09-16 14:33:56 (1 month ago)	2026-09-16T14:33:56Z Minecraft server scanner	Port Scan
🇩🇪 conseilgouz	2026-09-02 19:35:41 (1 month ago)	ave-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-09-02 19:17:36 (1 month ago)	coe-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-09-02 16:50:12 (1 month ago)	doe-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-09-02 16:34:32 (1 month ago)	mae-Joomla Admin : try to force the door...	Hacking
🇩🇪 ecs.ge	2026-09-02 10:44:12 (1 month ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇦🇺 Bay13	2026-09-02 10:05:43 (1 month ago)	CrowdSec:custom/modsecurity	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇿 185.87.121.1

🇨🇳 183.233.149.100

🇨🇳 183.6.102.122

🇵🇰 182.189.61.129

🇮🇩 103.99.27.125

🇮🇳 66.116.241.89

🇳🇱 45.148.10.141

🇹🇷 212.87.221.213

🇰🇷 210.99.124.119

🇺🇸 206.189.199.112

🇧🇪 198.235.24.247

🇵🇱 195.205.4.160

🇳🇱 193.47.62.69

🇫🇷 185.252.234.32

🇳🇱 185.223.235.40

🇨🇳 183.224.123.132

🇮🇳 182.70.63.221

🇯🇵 175.108.251.72

🇺🇸 172.252.223.167

🇺🇸 172.5.216.195