JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.254.76.62

85.254.76.62 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 18%: ?

18%

ISP	SIA BITE Latvija
Usage Type	Fixed Line ISP
ASN	AS210906
Domain Name	bite.lv
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.254.76.62

Whois 85.254.76.62

IP Abuse Reports for 85.254.76.62:

This IP address has been reported a total of 9 times from 6 distinct sources. 85.254.76.62 was first reported on June 20th 2025, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 HandyTreff.de	2026-07-04 08:35:18 (5 days ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -97.602 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -97.602 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0. show less	Web App Attack Bad Web Bot
🇦🇺 prologic	2026-06-12 20:59:01 (3 weeks ago)	Coordinated application-layer DDoS against git.mills.io (self-hosted Gitea), 2026-06-12 ~20:30-21:10 ... show more Coordinated application-layer DDoS against git.mills.io (self-hosted Gitea), 2026-06-12 ~20:30-21:10 UTC. Deliberately expensive multi-label Gitea issue-search queries (/issues?type=all&state=closed&sort=...&labels=<multiple IDs>, ~60-113s CPU each) flooded the backend via proxy/hosting networks. ~36,700 source IPs, ~1 request per IP, identical TLS fingerprint (TLS1.3 0x1301) and one spoofed Chrome UA = single automated tool. show less	DDoS Attack Web App Attack
Anonymous	2026-05-27 04:23:34 (1 month ago)	Malicious activity detected	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 13:03:15 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 85.254.76.62 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 85.254.76.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 09:03:06.577240 2026] [security2:error] [pid 12171:tid 12171] [client 85.254.76.62:37254] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.scoutinsignia.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.scoutinsignia.com"] [uri "/icons/WS_FTP.LOG"] [unique_id "agcZipEu5yKYN-vS10xeSQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-19 23:02:40 (7 months ago)	Malicious activity detected	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-11-06 14:56:07 (8 months ago)	(mod_security) mod_security (id:225170) triggered by 85.254.76.62 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 85.254.76.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 06 09:55:57.523219 2025] [security2:error] [pid 9058:tid 9058] [client 85.254.76.62:63804] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.vangentholding.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.vangentholding.com"] [uri "/wp-json/wp/v2/users/32780"] [unique_id "aQy2_QRn_gAhcAzusaEuQgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-11-04 23:02:06 (8 months ago)	ThreatBook Intelligence: vpn_proxy more details on http://threatbook.io/ip/85.254.76.62 2025-11-04 0 ... show more ThreatBook Intelligence: vpn_proxy more details on http://threatbook.io/ip/85.254.76.62 2025-11-04 06:53:53 /cc.gif show less	Web App Attack
🇨🇭 backslash	2025-10-17 00:15:29 (8 months ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot
🇺🇸 TPI-Abuse	2025-06-20 21:19:09 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 85.254.76.62 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 85.254.76.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 20 17:19:03.557195 2025] [security2:error] [pid 2798165:tid 2798165] [client 85.254.76.62:54078] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|elcalamo.com\|F\|2"] [data ".pdb"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elcalamo.com"] [uri "/pda/turra-desafinada_txt.PDB"] [unique_id "aFXQR29O7_XYhYDj6ti4pgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 198.46.134.48

🇰🇷 211.223.107.86

🇵🇰 182.189.48.207

🇺🇸 109.105.210.55

🇹🇷 94.154.43.177

🇩🇪 84.233.195.152

🇺🇸 64.23.135.0

🇺🇸 44.252.48.46

🇺🇸 44.42.142.103

🇺🇸 174.138.32.217

🇬🇧 154.16.44.9

🇰🇷 121.142.87.218

🇮🇩 119.47.90.19

🇹🇼 101.13.2.182

🇩🇪 89.57.128.31

🇨🇦 85.217.149.46

🇺🇸 66.132.195.90

🇱🇺 64.89.161.93

🇺🇸 44.205.188.198

🇫🇮 37.27.206.243