JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

102.209.119.12

Neutral Activity

Abuse confidence score ?

0% Low Risk

51 reports

27 reporters · latest 8 months ago

ISP	VPS Hostafrica
Usage Type	Data Center/Web Hosting/Transit
ASN	AS329184
Domain Name	hostafrica.co.za
Country	🇿🇦 South Africa
City	Johannesburg, Gauteng

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

102.209.119.12 has been reported 51 times. The most recent report is from 8 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 102.209.119.12

Export CSV

This IP address has been reported a total of 51 times from 27 distinct sources. 102.209.119.12 was first reported on November 25th 2025, and the most recent report was 8 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-01-20 01:17:21 (8 months ago)	Fail2ban: all-services - 2026/01/08 10:58:55102.209.119.12 - - [08/Jan/2026:11:03:39 -0500] "GET /.e ... show more Fail2ban: all-services - 2026/01/08 10:58:55102.209.119.12 - - [08/Jan/2026:11:03:39 -0500] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" attempts show less	Hacking Web App Attack
Anonymous	2026-01-12 02:17:53 (9 months ago)	Fail2ban: all-services - 2026/01/08 10:58:55102.209.119.12 - - [08/Jan/2026:11:03:39 -0500] "GET /.e ... show more Fail2ban: all-services - 2026/01/08 10:58:55102.209.119.12 - - [08/Jan/2026:11:03:39 -0500] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" attempts show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-01-11 09:05:27 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 102.209.119.12 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 102.209.119.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 11 04:05:21.915862 2026] [security2:error] [pid 16179:tid 16179] [client 102.209.119.12:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hvacs-aircon.com"] [uri "/.env"] [unique_id "aWNn0Ya9O-ODgOvcdwa36AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 myagent.site	2026-01-11 04:51:38 (9 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇩🇪 conseilgouz	2026-01-09 00:45:29 (9 months ago)	ece-17 : Block hidden directories=>/.env(/)	Hacking
🇬🇧 Swiptly	2026-01-08 10:47:47 (9 months ago)	Bot scanning for environment files .env .env/\* ...	Web App Attack
🇺🇸 TPI-Abuse	2026-01-08 10:36:04 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 102.209.119.12 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 102.209.119.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 08 05:36:01.404676 2026] [security2:error] [pid 4842:tid 4842] [client 102.209.119.12:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "totalsafe-security.com"] [uri "/.env"] [unique_id "aV-IkZ8pNevPaIPcuhu2bgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 octageeks.com	2026-01-08 05:08:21 (9 months ago)	Wordpress malicious attack:[octawpauthor]	Web App Attack
🇬🇧 [email protected]	2026-01-08 00:32:10 (9 months ago)	...	Brute-Force SSH
🇳🇱 enpepet	2026-01-07 23:10:19 (9 months ago)	GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT ... show more GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 URL:/.env show less	Port Scan Hacking Brute-Force Bad Web Bot
🇫🇷 bigorre.org	2026-01-07 10:15:19 (9 months ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
🇩🇪 sdos.es	2026-01-07 09:29:59 (9 months ago)	"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env"	Web App Attack
🇨🇭 YF	2026-01-07 03:05:02 (9 months ago)	Attempted access to sensitive files	Web App Attack
🇮🇩 securejdprop	2026-01-07 02:56:44 (9 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO Request to ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO Request to Hidden Environment File - Inbound). Ip 102.209.119.12 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-01-07 02:56:42.799539074 +0000 UTC show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-07 01:55:33 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 102.209.119.12 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 102.209.119.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 06 20:55:25.976768 2026] [security2:error] [pid 7207:tid 7207] [client 102.209.119.12:64823] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kippert.com"] [uri "/.env"] [unique_id "aV29De6FUDHIpFVPxidPSAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 163.223.8.141

🇳🇱 109.160.32.127

🇹🇷 88.255.189.44

🇳🇴 185.12.59.118

🇲🇴 182.93.50.90

🇧🇷 172.69.11.206

🇻🇳 160.30.112.134

🇳🇱 109.160.32.169

🇮🇳 103.225.132.167

🇳🇱 77.91.71.91

🇳🇱 67.159.19.106

🇰🇿 2.78.224.127

🇳🇱 195.178.110.218

🇬🇧 178.79.132.110

🇧🇷 177.136.224.34

🇫🇷 161.97.180.57

🇮🇩 103.172.20.218

🇺🇦 91.221.137.207

🇧🇬 79.124.58.162

🇧🇬 78.128.113.98