JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.237.194.4

85.237.194.4 was found in our database!

This IP was reported 105 times. Confidence of Abuse is 0%: ?

ISP	John Macleod trading as Howick Digital
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	howickdigital.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.237.194.4

Whois 85.237.194.4

IP Abuse Reports for 85.237.194.4:

This IP address has been reported a total of 105 times from 37 distinct sources. 85.237.194.4 was first reported on July 9th 2023, and the most recent report was 8 months ago.

Old Reports: The most recent abuse report for this IP address is from 8 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-02-03 13:49:15 (8 months ago)	tls scan	Port Scan
🇧🇪 cmbplf	2026-01-28 10:26:00 (8 months ago)	264 requests with url.path /.well-known/pki-validation/.php 224 requests with url.path /.well-k ... show more 264 requests with url.path /.well-known/pki-validation/.php 224 requests with url.path /.well-known/acme-challenge/*.php show less	Brute-Force Bad Web Bot
🇩🇪 Mr-Money	2026-01-27 00:05:58 (8 months ago)	scenario: crowdsecurity/http-wordpress-scan - events: 4	Hacking Web App Attack
🇳🇱 Mangelot Hosting	2026-01-26 21:18:03 (8 months ago)	(db_admin_scan) srv101 DB admin scan 85.237.194.4 (US/United States/-): 1 in the last 3600 secs; Por ... show more (db_admin_scan) srv101 DB admin scan 85.237.194.4 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇫🇷 dynamix	2026-01-26 20:54:37 (8 months ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-01-26 20:54:37 (8 months ago)	Multiple, malicious web requests detected	Port Scan Hacking
Anonymous	2026-01-26 20:31:01 (8 months ago)	wordpress-trap	Web App Attack
Anonymous	2025-11-30 03:13:07 (10 months ago)	wordpress-trap	Web App Attack
🇸🇬 anotherwatcher	2025-11-11 19:08:41 (11 months ago)	bad bot	Bad Web Bot
🇺🇸 TPI-Abuse	2025-11-11 06:37:35 (11 months ago)	(mod_security) mod_security (id:210492) triggered by 85.237.194.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 85.237.194.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 11 01:37:27.648275 2025] [security2:error] [pid 23057:tid 23057] [client 85.237.194.4:58157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "homeschoolwv.com"] [uri "/core/.env"] [unique_id "aRLZp0SgYizByDcgKGGiYgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-10 06:47:49 (11 months ago)	(mod_security) mod_security (id:210492) triggered by 85.237.194.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 85.237.194.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 10 01:47:39.093825 2025] [security2:error] [pid 3641:tid 3641] [client 85.237.194.4:42009] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "n3fjp.com"] [uri "/.env.productions"] [unique_id "aRGKi28k1JrbpP6fIhNbXwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 jjnxpct	2025-11-09 04:45:09 (11 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.aws/credentials (Rule ID: 930130) - Restricted File Access Attempt show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-11-08 23:38:43 (11 months ago)	(mod_security) mod_security (id:210492) triggered by 85.237.194.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 85.237.194.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 08 18:38:37.020839 2025] [security2:error] [pid 18650:tid 18668] [client 85.237.194.4:56845] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "x2cc.net"] [uri "/.env.example"] [unique_id "aQ_Ufd17OwJzYMN26FrPGQAAAUY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 octageeks.com	2025-11-07 05:06:48 (11 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
Anonymous	2025-11-06 19:40:02 (11 months ago)	suspicious request in access.log	Web App Attack

Showing 1 to 15 of 105 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 220.89.191.123

🇹🇳 196.187.152.67

🇩🇪 167.94.145.25

🇩🇪 164.90.177.255

🇺🇸 162.216.150.156

🇺🇸 162.215.175.52

🇺🇸 147.185.132.33

🇳🇱 109.160.32.174

🇳🇱 109.160.32.160

🇲🇦 105.157.180.56

🇨🇳 49.74.192.139

🇳🇱 45.115.26.149

🇳🇬 41.207.248.138

🇰🇷 27.100.134.74

🇵🇱 2a03:cfc0:8000:2d::c122:d62a

🇨🇦 207.219.222.29

🇲🇽 187.161.142.166

🇮🇶 185.124.149.33

🇸🇱 102.206.185.231

🇩🇪 43.228.157.194