This IP address has been reported a total of
7
times from
7 distinct
sources.
104.196.127.12 was first reported on
October 19th 2026 , and the most recent report was
4 days ago Germany
with 3
reports;
France
with 1
report;
United Kingdom of Great Britain and Northern Ireland
with 1
report.
The most common categories in these recent reports were:
Web App Attack
5
times;
Hacking
2
times;
Brute-Force
2
times;
Port Scan
2
times;
Exploited Host
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
wordpresshosting.solutions
2026-10-19 11:06:05
(4 days ago)
WordPress login/xmlrpc abuse or user enumeration detected. Evidence: [IP] - - [19/Oct/2026:11:06:04 ...
show more
WordPress login/xmlrpc abuse or user enumeration detected. Evidence: [IP] - - [19/Oct/2026:11:06:04 +0000] "GET /wp-admin/css/admin.php HTTP/1.1" 404 45593 "https://[DOMAIN]/wp-admin/css/admin.php" "Go-http-client/2.0"
[IP] - - [19/Oct/2026:11:06:04 +0000] "GET /wp-admin/css/about.php HTTP/1.1" 404 45593 "https://[DOMAIN]//wp-admin/css/about.php" "Go-http-client/2.0"
show less
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-10-19 11:04:07
(4 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
maxpower
2026-10-19 10:51:40
(4 days ago)
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 104.196.127.12 (US/United States/12.127.196.104.bc. ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 104.196.127.12 (US/United States/12.127.196.104.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.196.127.12 - - [19/Oct/2026:12:51:37 +0200] "GET /bless.php HTTP/1.1" 301 284 "-" "Go-http-client/1.1" "-" host=pescarafestival.it
show less
Port Scan
🇬🇧
Marten Mark
2026-10-19 10:06:46
(4 days ago)
104.196.127.12 - - [19/Oct/2026:10:06:40 +0000] "GET /000.php HTTP/2.0" 404 110 "http://cfi.co/000.p ...
show more
104.196.127.12 - - [19/Oct/2026:10:06:40 +0000] "GET /000.php HTTP/2.0" 404 110 "http://cfi.co/000.php" "Go-http-client/2.0"
104.196.127.12 - - [19/Oct/2026:10:06:40 +0000] "GET /wp-content/about.php HTTP/2.0" 404 110 "http://cfi.co/wp-content/about.php" "Go-http-client/2.0"
104.196.127.12 - - [19/Oct/2026:10:06:40 +0000] "GET /wp-content/wp-setting.php HTTP/2.0" 404 110 "http://cfi.co/wp-content/wp-setting.php#admin@admin" "Go-http-client/2.0"
104.196.127.12 - - [19/Oct/2026:10:06:41 +0000] "GET /wp-includes/hp2.php HTTP/2.0" 404 110 "http://cfi.co/wp-includes/hp2.php" "Go-http-client/2.0"
104.196.127.12 - - [19/Oct/2026:10:06:41 +0000] "GET /bless.php HTTP/2.0" 404 110 "http://cfi.co/bless.php#888xyz999" "Go-http-client/2.0"
104.196.127.12 - - [19/Oct/2026:10:06:41 +0000] "GET /wp-content/goods.php HTTP/2.0" 404 110 "http://cfi.co/wp-content/goods.php" "Go-http-client/2.0"
104.196.127.12 - - [19/Oct/2026:10:06:41 +0000] "GET /blurbs.php HTTP/2.0" 404 110 "http://cfi.co/blurbs.php#888
...
show less
Port Scan
Web App Attack
🇩🇪
h7ex
2026-10-19 10:01:08
(4 days ago)
Attempted execution of scripts via Apache (noscripts) (Jail: apache-noscript)
Hacking
Exploited Host
🇮🇹
VHosting
2026-10-19 09:35:04
(4 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
ramazan
2026-10-19 09:27:51
(4 days ago)
Fail2Ban: nginx-4xx | Failures: 10 | Log: //wp-admin/css/about.php /000.php /bless.php /blurbs.php / ...
show more
Fail2Ban: nginx-4xx | Failures: 10 | Log: //wp-admin/css/about.php /000.php /bless.php /blurbs.php /wp-admin/css/admin.php
show less
Web App Attack
Hacking
Showing 1 to
7
of 7 reports
