JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

85.9.212.129

Activity Trending Down

Abuse Confidence Score

31% Elevated

19 reports

17 reporters · latest 1 month ago

ISP: UpCloud Cloud Servers
Usage Type: Data Center/Web Hosting/Transit
ASN: AS202053
Hostname(s): 85-9-212-129.nl-ams1.upcloud.host
Domain Name: upcloud.com
Country: 🇳🇱 Netherlands
City: Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

19 from 17 distinct reporters

First reported

September 25th 2026

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 6 🇩🇪 Germany 3 🇦🇺 Australia 2

Most common categories Web App Attack 18 Brute-Force 9 Hacking 7 Bad Web Bot 2 Port Scan 1

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-27 20:39:39 UTC · (1 month ago)	(mod_security) mod_security (id:211220) triggered by 85.9.212.129 (85-9-212-129.nl-ams1.upcloud.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 16:39:35.827824 2026] [security2:error] [pid 1650:tid 1650] [ ... show more (mod_security) mod_security (id:211220) triggered by 85.9.212.129 (85-9-212-129.nl-ams1.upcloud.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 16:39:35.827824 2026] [security2:error] [pid 1650:tid 1650] [client 85.9.212.129:60202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS_NAMES: config-create /<?. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|www.bikiniadvice.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bikiniadvice.com"] [uri "/"] [unique_id "arl_BxBeQ2VS8d_w02vBtQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-27 03:22:19 UTC · (1 month ago)	This address sent web requests carrying PHP code in the query string — an attempt to execute code on our server, drop a web shell or exploit a remote code execution flaw. This is a direct attack on the sites we host, blocked on sight. Please check th ... show more This address sent web requests carrying PHP code in the query string — an attempt to execute code on our server, drop a web shell or exploit a remote code execution flaw. This is a direct attack on the sites we host, blocked on sight. Please check the machine behind it for malware or an attack tool. \| method: POST \| path: / \| query: +config-create+/<?=passthru(chr(101).chr(99).chr(104).chr(111).chr(32).chr(119).chr(50).chr(115).chr(57).chr(57).chr(100).chr(10 \| 2026-09-27 03:22 UTC show less	Hacking Web App Attack
Anonymous	2026-09-27 03:16:34 UTC · (1 month ago)	[27/Sep/2026:03:16:33.335206 +0000] ariKkbPwl_g0eANV7IS5lQAAAAQ 85.9.212.129 53654 [redacted] 443 [27/Sep/2026:03:16:33.983574 +0000] ariKkX75qaS5-myfqb1eBQAAAAw 85.9.212.129 53666 [redacted] 443	Hacking Web App Attack
Anonymous	2026-09-27 01:31:39 UTC · (1 month ago)	Blocked by ModSec and CSF	Port Scan
🇸🇪 vaia.cloud	2026-09-26 19:30:01 UTC · (1 month ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇲🇾 Rizzy	2026-09-26 16:41:49 UTC · (1 month ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇦🇺 2000cn.com.au	2026-09-26 16:32:46 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-probing	Web App Attack Hacking
🇧🇪 Ivo Vynckier	2026-09-26 14:29:00 UTC · (1 month ago)	85.9.212.129 - - [26/Sep/2026:02:29:09 +0200] "GET /?rest_route=/ HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" 85.9.212.129 - - [26/Sep/2026:02:29:09 ... show more 85.9.212.129 - - [26/Sep/2026:02:29:09 +0200] "GET /?rest_route=/ HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" 85.9.212.129 - - [26/Sep/2026:02:29:09 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 404 6263 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0" 85.9.212.129 - - [26/Sep/2026:02:29:09 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 200 11012 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" show less	Web App Attack Hacking
🇩🇪 ghostwarriors	2026-09-26 09:50:03 UTC · (1 month ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇨🇭 Origon	2026-09-26 09:40:19 UTC · (1 month ago)	http-cve-probing - IP: 85.9.212.129 - time="2026-09-26T11:40:19+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-cve-probing by ip 85.9.212.129 (FI/202053) : 4h ban on Ip 85.9.212.129" module=db	Web App Attack
🇩🇪 yitzhaq	2026-09-26 09:24:16 UTC · (1 month ago)	85.9.212.129 - - [26/Sep/2026:11:24:11 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 403 4450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0" 85.9.212.129 - - [26/Sep/2026:11:24:13 +0200] "POST /wp-json/batch/v1 ... show more 85.9.212.129 - - [26/Sep/2026:11:24:11 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 403 4450 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0" 85.9.212.129 - - [26/Sep/2026:11:24:13 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 403 4450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" 85.9.212.129 - - [26/Sep/2026:11:24:14 +0200] "POST /index.php/wp-json/batch/v1 HTTP/1.1" 403 4451 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36" show less	Web App Attack Hacking
🇦🇺 afleventoffice.com.au	2026-09-26 05:45:08 UTC · (1 month ago)	POST /wp-json/batch/v1 HTTP/1.1	Web App Attack
🇺🇸 mnsf	2026-09-26 05:05:11 UTC · (1 month ago)	Abuse Detected (20)	Brute-Force Web App Attack
Anonymous	2026-09-26 04:58:18 UTC · (1 month ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇺🇦 URAN Publishing Service	2026-09-26 03:25:54 UTC · (1 month ago)	[26/Sep/2026:06:25:54 +0300] -- 85.9.212.129 Ban reason: Scanner [CMS_GENERIC] \| Request: POST /wp-json/batch/v1 HTTP/1.1	Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 213.209.159.226

🇫🇮 147.185.133.62

🇺🇸 91.230.168.202

🇺🇸 70.183.226.45

🇺🇸 34.127.26.157

🇺🇸 4.148.17.148

🇨🇳 222.186.150.31

🇳🇱 213.209.159.11

🇺🇸 96.79.12.198

🇫🇷 91.231.89.134

🇰🇷 61.75.49.7

🇨🇳 36.33.19.48

🇺🇸 34.181.191.129

🇺🇸 8.230.98.86

🇰🇷 221.158.100.113

🇳🇱 204.76.203.212

🇲🇽 187.190.35.163

🇧🇷 168.227.9.32

🇵🇭 136.158.120.75

🇺🇸 108.94.149.99