JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

85.237.194.16

Neutral Activity

Abuse confidence score ?

0% Low Risk

111 reports

30 reporters · latest 8 months ago

ISP	John Macleod trading as Howick Digital
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	howickdigital.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

85.237.194.16 has been reported 111 times. The most recent report is from 8 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 85.237.194.16

Export CSV

This IP address has been reported a total of 111 times from 30 distinct sources. 85.237.194.16 was first reported on March 4th 2023, and the most recent report was 8 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2026-01-28 11:30:38 (8 months ago)	370 requests with url.path /.well-known/pki-validation/.php 314 requests with url.path /.well-k ... show more 370 requests with url.path /.well-known/pki-validation/.php 314 requests with url.path /.well-known/acme-challenge/*.php show less	Brute-Force Bad Web Bot
🇫🇷 dynamix	2026-01-27 03:20:21 (8 months ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-01-26 20:50:06 (8 months ago)	wordpress-trap	Web App Attack
🇺🇸 csp0829	2026-01-21 18:03:58 (8 months ago)	Asterisk/FreePBX Auth Failure for user: admin	Brute-Force
🇺🇸 csp0829	2026-01-09 16:26:53 (9 months ago)	Asterisk/FreePBX Auth Failure for user: admin	Brute-Force
Anonymous	2025-12-25 15:19:49 (9 months ago)	Malicious activity detected	Hacking Web App Attack
Anonymous	2025-12-24 20:45:13 (9 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇨🇭 backslash	2025-11-30 07:20:06 (10 months ago)	block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638	Bad Web Bot
Anonymous	2025-11-20 01:10:11 (10 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇪🇸 el-brujo	2025-11-15 11:26:32 (11 months ago)	15/Nov/2025:12:26:31.953450 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 15/Nov/2025:12:26:31.953450 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 85.237.194.16] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ns2.elhacker.net"] [uri "/.env.example"] [unique_id "aRhjZ4PG8LpbNTPNjnCCHQAAdzI"] ... show less	Hacking Web App Attack
Anonymous	2025-11-15 03:35:41 (11 months ago)	85.237.194.16 - - [15/Nov/2025:03:35:38 +0000] "GET /.env.backup HTTP/1.1" 404 6261 "-" "-" ...	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-10 06:47:48 (11 months ago)	(mod_security) mod_security (id:210492) triggered by 85.237.194.16 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 85.237.194.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 10 01:47:37.012981 2025] [security2:error] [pid 3520:tid 3520] [client 85.237.194.16:37937] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "n3fjp.com"] [uri "/.env.backup"] [unique_id "aRGKiW4ul4VsNo0mDe9n9AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 el-brujo	2025-11-09 13:58:55 (11 months ago)	Cloudflare WAF: Request Path: /.env.bak Request Query: Host: elhacker.net userAgent: Action: block ... show more Cloudflare WAF: Request Path: /.env.bak Request Query: Host: elhacker.net userAgent: Action: block Source: firewallManaged ASN Description: SECFIREWALLAS Country: US Method: GET Timestamp: 2025-11-09T13:58:55Z ruleId: c04705c7adee4ce3a763bd5e18135e0c. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇪🇸 el-brujo	2025-11-09 10:09:54 (11 months ago)	Cloudflare WAF: Request Path: /backend/.env Request Query: Host: foro.elhacker.net userAgent: Acti ... show more Cloudflare WAF: Request Path: /backend/.env Request Query: Host: foro.elhacker.net userAgent: Action: block Source: firewallManaged ASN Description: SECFIREWALLAS Country: US Method: GET Timestamp: 2025-11-09T10:09:54Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇫🇮 Shaik Sai Meera	2025-11-08 06:00:31 (11 months ago)	IM360 WAF: Hidden file access	Brute-Force

Showing 1 to 15 of 111 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 109.160.32.41

🇺🇸 104.168.163.3

🇺🇸 64.62.197.58

🇸🇬 47.84.47.217

🇺🇸 184.186.73.93

🇺🇸 152.32.236.102

🇰🇷 112.170.238.104

🇹🇼 104.199.176.250

🇺🇸 64.62.197.116

🇱🇹 62.60.130.253

🇫🇷 54.36.246.197

🇭🇰 49.213.6.30

🇧🇪 34.52.133.111

🇺🇸 206.189.75.120

🇺🇸 205.210.31.41

🇺🇸 167.71.153.165

🇬🇧 165.154.129.43

🇺🇸 103.215.74.112

🇷🇺 95.188.21.65

🇬🇧 77.67.26.212