JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.12.182.254

130.12.182.254 was found in our database!

This IP was reported 1,663 times. Confidence of Abuse is 100%: ?

100%

ISP	Netiface LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197769
Domain Name	abusehandler.net
Country	🇩🇪 Germany
City	Schonau am Konigssee, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.12.182.254

Whois 130.12.182.254

IP Abuse Reports for 130.12.182.254:

This IP address has been reported a total of 1,663 times from 467 distinct sources. 130.12.182.254 was first reported on January 23rd 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Catalin Negru	2026-09-03 16:02:08 (1 hour ago)	Recidive ban by fail2ban on server.blackbit.ro	Brute-Force
🇵🇱 Budyn	2026-09-03 15:21:36 (2 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.astropot.store \| URI: /.env \| UA: Go-http-client/2.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇦🇺 neilwal	2026-09-03 15:20:03 (2 hours ago)	Web Probe (443): beyondzugzwang.myvnc.com:443 130.12.182.254 - - [04/Sep/2026:01:20:02 +1000] "GET / ... show more Web Probe (443): beyondzugzwang.myvnc.com:443 130.12.182.254 - - [04/Sep/2026:01:20:02 +1000] "GET /.env HTTP/2.0" 401 634 "-" "Go-http-client/2.0" beyondzugzwang.myvnc.com:443 130.12.182.254 - - [04/Sep/2026:01:20:02 +1000] "GET /.env HTTP/2.0" 401 639 "-" "Go-http-client/2.0" beyondzugzwang.myvnc.com:443 130.12.182.254 - - [04/Sep/2026:01:20:03 +1000] "GET /.git/HEAD HTTP/2.0" 401 634 "-" "Go-http-client/2.0" show less	Web App Attack
🇨🇭 4server	2026-09-03 14:35:19 (3 hours ago)	[ThuSep0316:35:13.6384242026][security2:error][pid493233:tid493400][client130.12.182.254:0]ModSecuri ... show more [ThuSep0316:35:13.6384242026][security2:error][pid493233:tid493400][client130.12.182.254:0]ModSecurity:Accessdeniedwithcode403$phase1$.Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.swiss-web-hosting.hostingedominio.net\"][uri\"/.env\"][unique_id\"apmFoZDWuJBe6Bl-7y5y6wAAAIA\"] show less	Hacking Web App Attack
🇦🇺 Klaverstyn	2026-09-03 13:38:40 (4 hours ago)	Repeated 403 Forbidden responses	Web App Attack
🇦🇺 nzhost.co.nz	2026-09-03 13:08:59 (4 hours ago)	$f2bV_matches	Hacking Brute-Force
🇩🇪 BlueWire Hosting	2026-09-03 11:40:35 (6 hours ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇩🇪 hidemail.app	2026-09-03 10:29:08 (7 hours ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇺🇸 daveoctober	2026-09-03 10:16:58 (7 hours ago)	October Sentinel: honeypot triggered	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-03 09:15:52 (8 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cluster.teddypot.tech \| URI: /.env \| UA: Go-http-client/2.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 4server	2026-09-03 08:06:39 (9 hours ago)	[ThuSep0310:06:37.0434292026][security2:error][pid2624631:tid2624755][client130.12.182.254:0]ModSecu ... show more [ThuSep0310:06:37.0434292026][security2:error][pid2624631:tid2624755][client130.12.182.254:0]ModSecurity:Accessdeniedwithcode403$phase2$.OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded$TotalScore:5$\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"biling.maurokorangraf.ch\"][uri\"/.git/HEAD\"][unique_id\"apkqjaFMp19pGMOTmtxY-wAAANY\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 Bedios GmbH	2026-09-03 06:39:10 (11 hours ago)	Login credentials theft attempt	Hacking
🇺🇸 brantknudson.org	2026-09-03 06:24:42 (11 hours ago)	Incorrect Host header	Web App Attack Brute-Force
🇫🇮 ☠\|ʂɧąɖơῳ\|☠	2026-09-03 06:13:28 (11 hours ago)	[2026-09-03 06:13:28 UTC] Vulnerability/exploit scanning detected from 130.12.182.254 () PATHS: unkn ... show more [2026-09-03 06:13:28 UTC] Vulnerability/exploit scanning detected from 130.12.182.254 () PATHS: unknown show less	Bad Web Bot Web App Attack
🇺🇸 Sonoflet	2026-09-03 04:08:56 (13 hours ago)	CrowdSec detection \| scenario: appsec-vpatch	Web App Attack

Showing 1 to 15 of 1663 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 185.39.118.137

🇨🇳 47.94.131.134

🇷🇴 193.46.255.86

🇷🇺 178.74.109.188

🇺🇸 151.240.56.62

🇺🇸 147.185.132.177

🇺🇸 147.185.132.166

🇳🇱 85.11.167.237

🇳🇱 193.47.62.69

🇹🇷 185.67.204.249

🇰🇷 121.164.135.251

🇨🇳 121.40.47.123

🇨🇳 118.250.1.182

🇨🇦 85.217.149.37

🇸🇪 83.226.56.106

🇰🇷 43.131.253.14

🇻🇪 38.74.244.165

🇺🇸 34.75.89.130

🇻🇳 14.231.142.210

🇧🇪 198.235.24.240