JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

130.12.182.254

Recent Activity

Abuse confidence score ?

100% Critical

2,696 reports

590 reporters · latest 11 hours ago

ISP	Netiface LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197769
Domain Name	abusehandler.net
Country	🇸🇮 Slovenia
City	Maribor, Urban Municipality of Maribor

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 130.12.182.254

Export CSV

This IP address has been reported a total of 2,696 times from 590 distinct sources. 130.12.182.254 was first reported on January 23rd 2026, and the most recent report was 11 hours ago. In the last 60 days, the top reporter locations were: Poland with 264 reports; Germany with 190 reports; United States of America with 190 reports. Over the same time period, 130.12.182.254 has changed country of origin 2 times. The most common categories in these recent reports were: Web App Attack 975 times; Bad Web Bot 514 times; Brute-Force 239 times; Hacking 214 times; Port Scan 77 times; Other 109 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 TheCoon	2026-10-24 16:06:01 (11 hours ago)	Automated: Honeypot scanner detected	Web App Attack Hacking
Anonymous	2026-10-24 13:42:52 (14 hours ago)	fail2ban jail apache-secrets-probe: 130.12.182.254 - - [24/Sep/2026:17:44:07 -0700] "GET /.env HTTP/ ... show more fail2ban jail apache-secrets-probe: 130.12.182.254 - - [24/Sep/2026:17:44:07 -0700] "GET /.env HTTP/1.1" 403 4407 "-" "Go-http-client/1.1" show less	Web App Attack
🇳🇱 Alt255	2026-10-24 12:28:08 (15 hours ago)	[cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [cb-15al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 130.12.182.254 - - [24/Oct/2026:14:27:48 +0200] "GET /.env HTTP/2.0" 403 441 "-" "Go-http-client/2.0" ... show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-24 12:05:14 (15 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.teddypot.online \| URI: /.env \| UA: Go-http-client/2.0 \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"SI","Cf-Connecting-Ip":"130.12.182.254","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4f8d939b93f8c44-FRA","Accept-Encoding":"gzip, br","X-Forwarded-For":"130.12.182.254"} show less	Bad Web Bot Web App Attack
🇫🇷 ventura-websolutions.de	2026-10-24 11:36:07 (16 hours ago)	Jan 24 14:36:09 server postfix/smtpd[2603463]: warning: unknown[130.12.182.254]: SASL LOGIN authenti ... show more Jan 24 14:36:09 server postfix/smtpd[2603463]: warning: unknown[130.12.182.254]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jan 25 00:10:18 server postfix/smtpd[2649957]: warning: unknown[130.12.182.254]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jan 25 02:57:44 server postfix/smtpd[2661567]: warning: unknown[130.12.182.254]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 show less	Brute-Force
🇳🇱 sembeek	2026-10-24 10:53:15 (17 hours ago)	remote code execution attempts: 4 attempts within 1 minute, seen by CrowdSec (reported by RemotePowe ... show more remote code execution attempts: 4 attempts within 1 minute, seen by CrowdSec (reported by RemotePower) show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-24 09:11:43 (18 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.astropot.space \| URI: /.env \| UA: Go-http-client/2.0 \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"SI","Cf-Connecting-Ip":"130.12.182.254","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4f7db0f3d2da63e-FRA","Accept-Encoding":"gzip, br","X-Forwarded-For":"130.12.182.254"} show less	Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-10-24 08:43:05 (19 hours ago)	(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 130.12.182.254 (SI/Slovenia/-): ... show more (web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 130.12.182.254 (SI/Slovenia/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇦🇺 Klaverstyn	2026-10-24 07:55:19 (20 hours ago)	Cross-vhost secrets/RCE probing campaign	Web App Attack Hacking
Anonymous	2026-10-24 07:35:16 (20 hours ago)	path attack /.env	Web App Attack
🇺🇸 daveoctober	2026-10-24 06:46:42 (21 hours ago)	October Sentinel: honeypot triggered	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-24 06:11:13 (21 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.definitelynotahoneypot.online \| URI: /.env \| UA: Go-http-client/2.0 \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"SI","Cf-Connecting-Ip":"130.12.182.254","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4f6d2a77e9239c7-FRA","Accept-Encoding":"gzip, br","X-Forwarded-For":"130.12.182.254"} show less	Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-10-24 06:05:34 (21 hours ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇦🇹 René Hickersberger	2026-10-24 03:53:30 (1 day ago)	malicious bot detected: violations="hit-honeypot"; user_agent="Go-http-client/2.0"	Web App Attack
🇵🇱 srebrakowski.com	2026-10-24 03:25:53 (1 day ago)	crowdsec/crowdsecurity/appsec-vpatch	Brute-Force

Showing 1 to 15 of 2696 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 188.240.59.24

🇳🇱 185.223.235.27

🇬🇧 154.16.44.68

🇹🇼 152.32.229.251

🇺🇸 66.132.195.221

🇺🇸 64.227.10.211

🇳🇱 45.156.87.34

🇳🇱 45.153.34.122

🇺🇸 20.230.87.166

🇺🇸 216.180.246.50

🇬🇧 213.166.84.34

🇧🇷 201.51.39.90

🇹🇼 198.235.24.106

🇳🇱 185.223.235.14

🇨🇳 182.88.7.74

🇬🇧 178.62.118.251

🇨🇳 120.48.71.14

🇲🇾 118.100.21.236

🇬🇧 86.38.187.68

🇺🇸 45.33.41.118