JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 85.237.212.243

85.237.212.243 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 24%: ?

24%

ISP	LIVAPROXY YAZILIM TICARET LIMITED SIRKETI
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	livaproxy.com
Country	🇵🇱 Poland
City	Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 85.237.212.243

Whois 85.237.212.243

IP Abuse Reports for 85.237.212.243:

This IP address has been reported a total of 24 times from 14 distinct sources. 85.237.212.243 was first reported on March 26th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 Bay13	2026-08-10 19:18:50 (1 week ago)	CrowdSec:custom/modsecurity	Web App Attack
🇮🇹 VHosting	2026-08-10 15:55:08 (1 week ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇬🇧 consul.to	2026-07-16 15:04:48 (1 month ago)	Web attack/malicious scanning detected	Web App Attack
🇦🇺 Anytech	2026-07-03 22:50:58 (1 month ago)	Blocked by Conn-Monitor: Automated form spam	Bad Web Bot Web App Attack
🇳🇱 DrLex0	2026-06-28 00:26:27 (1 month ago)	BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop. 85.237.212.243 443 - [28/Jun/2026:00:26:27 +0000] "GET [redacted] HTTP/1.1" 200 6908 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0" show less	Bad Web Bot Exploited Host
🇦🇺 oncord	2026-06-21 01:19:30 (1 month ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-06-12 21:03:48 (2 months ago)	(mod_security) mod_security (id:210801) triggered by 85.237.212.243 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210801) triggered by 85.237.212.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 17:03:44.425848 2026] [security2:error] [pid 3884:tid 3945] [client 85.237.212.243:39791] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site\|\|executiveaccounting.net\|F\|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "executiveaccounting.net"] [uri "/license.txt"] [unique_id "aix0MGAnlZDbbIwDOFxWkwAAAEw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 20:45:16 (2 months ago)	(mod_security) mod_security (id:210801) triggered by 85.237.212.243 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210801) triggered by 85.237.212.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 16:45:07.396904 2026] [security2:error] [pid 18555:tid 18555] [client 85.237.212.243:32861] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site\|\|zavijava.net\|F\|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "zavijava.net"] [uri "/license.txt"] [unique_id "aixv0yzJT-mlRrlEa-aweQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 20:16:04 (2 months ago)	(mod_security) mod_security (id:210801) triggered by 85.237.212.243 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210801) triggered by 85.237.212.243 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 16:16:01.042101 2026] [security2:error] [pid 8665:tid 8665] [client 85.237.212.243:54207] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "paros" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "17"] [id "210801"] [rev "2"] [msg "COMODO WAF: Request Indicates a Security Scanner Scanned the Site\|\|bennefeld.net\|F\|2"] [data "mozilla/5.0 (windows nt 5.1; rv:22.0) gecko/20100101 firefox/22.0 paros/3.2.13"] [severity "CRITICAL"] [tag "CWAF"] [tag "Agents"] [hostname "bennefeld.net"] [uri "/license.txt"] [unique_id "aixpATTNWJK_s8FxFsDE5wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-12 19:52:45 (2 months ago)	[FriJun1221:52:40.7368452026][security2:error][pid7964:tid8070][client85.237.212.243:0]ModSecurity:A ... show more [FriJun1221:52:40.7368452026][security2:error][pid7964:tid8070][client85.237.212.243:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:n\(\?:-stealth\\|sauditor\\|e\(\?:ssus\\|etwork-services-auditor\)\\|ikto\\|map\)\\|b\(\?:lack\?widow\\|rutus\\|ilbo\)\\|web\(\?:inspec\\|roo\)t\\|p\(\?:mafind\\|aros\\|avuk\)\\|cgichk\\|jaascois\\|\\\\\\\\.nasl\\|metis\\|w\(\?:ebtrendssecurityanalyzer\\|hcc\\|3af\\\\\\\\.sourceforge\\\\\\\\.net\)\\|\\\\\\\\bzmeu\\\\\\\\b\\|springenwerk\\|...\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"184\"][id\"330034\"][rev\"14\"][msg\"Atomicorp.comWAFRules:UnauthorizedVulnerabilityScannerdetected\"][data\"paros\"][severity\"CRITICAL\"][hostname\"rs-gaming.net\"][uri\"/license.txt\"][unique_id\"aixjiMD_ZM_mLCfGIZlYpAAAAJE\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 FeG Deutschland	2026-06-09 19:03:57 (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇩🇪 todix	2026-06-09 17:31:21 (2 months ago)	WebAttack or semilar from 85.237.212.243	Web App Attack
🇬🇧 consul.to	2026-05-31 18:23:27 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 consul.to	2026-05-27 03:13:41 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇨🇭 4server	2026-05-24 12:12:13 (2 months ago)	[SunMay2414:12:08.1566452026][security2:error][pid3416604:tid3416983][client85.237.212.243:0]ModSecu ... show more [SunMay2414:12:08.1566452026][security2:error][pid3416604:tid3416983][client85.237.212.243:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:10\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.giuristifriburgo.ch\"][uri\"/contatti-e-iscrizioni/\"][unique_id\"ahLrGClb9Ry9aCUT0-JXNgAAAE0\"]\,referer:https://www.giuristifriburgo.ch/contatti-e-iscrizioni/ show less	Hacking Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 187.155.89.163

🇺🇸 172.71.166.227

🇺🇸 147.185.132.205

🇺🇸 35.243.213.218

🇰🇿 2.57.97.188

🇦🇴 154.116.254.157

🇺🇸 147.185.132.150

🇨🇦 85.217.149.50

🇭🇰 59.188.114.121

🇺🇸 20.168.125.66

🇮🇩 202.155.94.200

🇫🇷 88.96.58.29

🇺🇸 34.148.205.86

🇧🇬 79.124.62.126

🇿🇦 41.173.43.34

🇰🇷 221.162.218.85

🇸🇬 43.128.120.55

🇨🇳 27.26.72.51

🇧🇷 189.51.232.18

🇦🇫 180.94.74.2