This IP address has been reported a total of
323
times from
136 distinct
sources.
85.239.147.8 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
Reported from Nginx log analysis 19. Log: 85.239.147.8 - - [05/Jun/2026:xx:xx:xx 0200] "GET / CSCOE ...
show moreReported from Nginx log analysis 19. Log: 85.239.147.8 - - [05/Jun/2026:xx:xx:xx 0200] "GET / CSCOE /logon.html HTTP/1.0" xxx xxx "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "-" "BG Bulgaria -" "AS213474" "HomeLine Broadband LLC" | 85.239.147.8 - - [05/Jun/2026:xx:xx:xx 0200] "GET / CSCOE /logon.html HTTP/1.0" xxx xxx "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "-" "BG Bulgaria -" "AS213474" "HomeLine Broadband LLC"
show less
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 2× edge-block in 10 ...
show more[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 2× edge-block in 10m window.
Origin: FI / AS213474 HomeLine Broadband LLC
Active: 07:07:45→07:07:46 UTC
Volume: 2 HTTP req
Probed: /+CSCOE+/logon.html
Status mix: 444×1 400×1
Vhost fishing: 67.217.240.72
UA: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
Anonymous
[05/Jun/2026:17:08:01 +1000] "GET / HTTP/1.0" 400 402 [05/Jun/2026:17:08:08 +1000] "GET /+CSCOE+/log ...
show more[05/Jun/2026:17:08:01 +1000] "GET / HTTP/1.0" 400 402 [05/Jun/2026:17:08:08 +1000] "GET /+CSCOE+/logon.html HTTP/1.0" 404 236 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
show less
[AUTORAVALT][[05/06/2026 - 04:07:04 -03:00 UTC]
Attack from [85.239.147.8] Action: BLocKed
DDoS Att ...
show more[AUTORAVALT][[05/06/2026 - 04:07:04 -03:00 UTC]
Attack from [85.239.147.8] Action: BLocKed
DDoS Attack -> Participating in distributed denial-of-service.
Phishing -> Phishing websites and/or email.
Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam.
Blog Spam -> CMS blog comment spam.
Web App Attack -> Attempts to probe for or exploit install]
...
show less
DDoS Attack
Phishing
Web Spam
Blog Spam
Web App Attack
Repeated bad requests to web service - Repeat offender 85.239.147.8 banned at least 2 times in the l ...
show moreRepeated bad requests to web service - Repeat offender 85.239.147.8 banned at least 2 times in the last 7 days
show less
Connection to port 12589 with data transfer.
Data preview: GET /remote/login HTTP/1.0
Host: 107.175 ...
show moreConnection to port 12589 with data transfer.
Data preview: GET /remote/login HTTP/1.0
Host: 107.175.212.44
Referer: https://www.google.com
User-Agent: Mozil
show less
Jun 4 06:21:45 [redacted] dovecot: imap-login: Disconnected (disconnected before auth was ready, wa ...
show moreJun 4 06:21:45 [redacted] dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=85.239.147.8, lip=[redacted], TLS handshaking: SSL_accept() failed: error:140
...
show less
Connection to port 10443 with data transfer.
Data preview: GET /remote/login HTTP/1.0
Host: 198.23. ...
show moreConnection to port 10443 with data transfer.
Data preview: GET /remote/login HTTP/1.0
Host: 198.23.188.201
Referer: https://www.google.com
User-Agent: Mozil
show less
Port Scan
Hacking
Showing 1 to
15
of 323 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩