JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.204.154.12

185.204.154.12 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 34%: ?

34%

ISP	NEXT Fiber SHPK
Usage Type	Fixed Line ISP
ASN	AS209442
Domain Name	onpointnetwork.al
Country	🇦🇱 Albania
City	Korce, Korce County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.204.154.12

Whois 185.204.154.12

IP Abuse Reports for 185.204.154.12:

This IP address has been reported a total of 13 times from 9 distinct sources. 185.204.154.12 was first reported on April 22nd 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-10-09 11:39:34 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 kosada.com	2026-10-09 08:57:56 (1 week ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=40&topics%5B1%5D=53&topics%5B2%5D=44&topics%5B3%5D=59 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇷🇺 AbuseIPDB informer	2026-10-08 10:34:04 (2 weeks ago)	nfdump top talker: 185.204.154.12 \| first seen 2026-10-08 13:34:04.672 \| duration 00:00:00.057 \| flo ... show more nfdump top talker: 185.204.154.12 \| first seen 2026-10-08 13:34:04.672 \| duration 00:00:00.057 \| flows=1 \| packets=20460 \| bytes=15.7 M \| pps=356 \| bps=2.2 M \| bpp=769 \| proto=any show less	DDoS Attack Port Scan Exploited Host
🇩🇪 LRob	2026-10-07 18:16:53 (2 weeks ago)	Shop search flood (L7 DDoS) \| path: /103-velo-route-triathlon-clm \| query: order=product.price.desc& ... show more Shop search flood (L7 DDoS) \| path: /103-velo-route-triathlon-clm \| query: order=product.price.desc&q=Taille-M/Selections-Promo \| src_port: 19702 show less	DDoS Attack Web App Attack
🇺🇸 kosada.com	2026-09-29 01:42:15 (3 weeks ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=58&topics%5B2%5D=62&topics%5B3%5D=40&topics%5B4%5D=64 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-28 21:44:55 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 185.204.154.12 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 185.204.154.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 17:44:51.948080 2026] [security2:error] [pid 19968:tid 19968] [client 185.204.154.12:9996] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|instituteofscience.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "instituteofscience.com"] [uri "/"] [unique_id "arrf09BqcjoGIy0_ZoV2LAAAABM"], referer: https://campanhaauto-hemoterapia.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nationaleventpros.com	2026-09-22 23:05:10 (1 month ago)	WordPress login attempt	Brute-Force
Anonymous	2026-09-19 08:35:23 (1 month ago)	denied traffic to a honeypot network. destination port 27603.	Port Scan Hacking
🇳🇱 DrLex0	2026-08-05 14:09:25 (2 months ago)	BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt an ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives 185.204.154.12 443 - [05/Aug/2026:14:09:25 +0000] "GET [redacted] HTTP/1.1" 503 6169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0" show less	Bad Web Bot Exploited Host
🇺🇸 kosada.com	2026-08-01 09:40:55 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-06-29 11:33:02 (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 SMARTNET	2026-05-27 06:03:53 (4 months ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 1175168a-7e6d-467e-bb9a-dd1cdfa3fb9e	DDoS Attack
🇩🇪 FeG Deutschland	2026-04-22 16:43:45 (6 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 171.231.195.7

🇯🇵 118.194.228.101

🇨🇳 112.38.90.230

🇧🇬 91.191.209.46

🇸🇬 43.172.195.153

🇨🇳 27.24.141.169

🇷🇺 217.24.185.244

🇩🇪 213.209.159.238

🇲🇾 202.184.148.229

🇺🇸 184.168.21.211

🇺🇸 170.106.146.54

🇰🇷 121.180.133.176

🇻🇳 113.185.59.132

🇳🇬 102.220.45.186

🇷🇺 95.24.199.6

🇺🇸 64.62.197.190

🇲🇾 47.250.91.187

🇳🇱 45.148.10.151

🇸🇬 43.172.195.96

🇯🇵 43.133.221.163