JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.239.59.144

85.239.59.144 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 0%: ?

ISP	JSC TIMEWEB
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9123
Domain Name	timeweb.com
Country	🇷🇺 Russian Federation
City	Moscow, Moscow

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.239.59.144

Whois 85.239.59.144

IP Abuse Reports for 85.239.59.144:

This IP address has been reported a total of 25 times from 10 distinct sources. 85.239.59.144 was first reported on January 19th 2022, and the most recent report was 8 months ago.

Old Reports: The most recent abuse report for this IP address is from 8 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2025-09-12 19:20:49 (8 months ago)	(mod_security) mod_security (id:210350) triggered by 85.239.59.144 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 85.239.59.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 12 15:20:46.439198 2025] [security2:error] [pid 32525:tid 32525] [client 85.239.59.144:54313] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|portfoliolighting.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "portfoliolighting.net"] [uri "/"] [unique_id "aMRyjkIVbOwg5UYEZveVVQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-08-29 23:48:57 (9 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-01-26 11:55:08 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2025-01-25 11:15:36 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2025-01-21 10:35:16 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2025-01-19 22:05:14 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2024-12-21 06:10:16 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2024-11-16 17:15:11 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2024-10-25 04:30:14 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
Anonymous	2024-10-14 19:10:44 (1 year ago)	Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx	Web App Attack
🇷🇺 sms.ru	2024-09-27 05:45:07 (1 year ago)	SMS pumping attack from foreign country	DDoS Attack
Anonymous	2024-06-27 09:03:10 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2024-06-22 15:09:05 (1 year ago)	(mod_security) mod_security (id:225170) triggered by 85.239.59.144 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 85.239.59.144 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 22 11:09:01.922831 2024] [security2:error] [pid 30161] [client 85.239.59.144:41773] [client 85.239.59.144] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|vjrott.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vjrott.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ZnbpDb0wwsmxWhTZzF8tcAAAABM"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-04-07 10:06:48 (2 years ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇻🇳 Xuan Can	2023-11-07 22:26:26 (2 years ago)	(mod_security) mod_security (id:210492) triggered by 85.239.59.144 (US/United States/-): 1 in the la ... show more (mod_security) mod_security (id:210492) triggered by 85.239.59.144 (US/United States/-): 1 in the last 3600 secs; Ports: 80,443; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 08 05:26:18.823314 2023] [security2:error] [pid 14164:tid 46944649910016] [client 85.239.59.144:11875] [client 85.239.59.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kb.pavietnam.vn"] [uri "/wp-config.php_bak"] [unique_id "ZUq5ipxQmFPc5l3HYjO3MAAAARM"] show less	Brute-Force SSH

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 209.85.221.67

🇺🇸 108.167.176.145

🇺🇸 107.150.102.47

🇷🇴 92.118.39.236

🇳🇱 34.91.147.161

🇺🇸 34.46.56.131

🇻🇳 27.79.6.241

🇮🇳 20.219.91.90

🇮🇩 210.79.191.170

🇭🇰 119.246.15.94

🇰🇷 119.203.109.69

🇳🇱 34.13.154.158

🇺🇸 20.65.194.160

🇧🇪 198.235.24.140

🇨🇳 150.255.100.244

🇨🇳 118.145.164.82

🇬🇪 91.151.136.148

🇱🇹 45.227.254.170

🇳🇱 45.148.10.157

🇺🇸 34.186.36.120