JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 129.146.127.63

129.146.127.63 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇺🇸 United States of America
City	Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 129.146.127.63

Whois 129.146.127.63

IP Abuse Reports for 129.146.127.63:

This IP address has been reported a total of 28 times from 23 distinct sources. 129.146.127.63 was first reported on August 24th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Omega Threat-ID	2026-08-27 18:46:09 (14 hours ago)	Omega Point Threat ID honeypot sensor observed: abuse-reported	Port Scan
🇳🇴 jad-abuse	2026-08-27 18:30:40 (14 hours ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe. Observed by 1 sensor(s); 5 hits. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-27 18:00:54 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 14:00:48.220130 2026] [security2:error] [pid 6240:tid 6240] [client 129.146.127.63:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "local639.com"] [uri "/.env"] [unique_id "apB7UOyERhGndsDKzVowSwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-08-27 13:08:56 (20 hours ago)	cloudlinux2 fail2ban: 2026-08-27 15:04:54,241 fail2ban.filter [1775]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-27 15:04:54,241 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 104.23.225.124 - 2026-08-27 15:04:53cloudlinux2 fail2ban: 2026-08-27 15:04:54,228 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 104.23.225.125 - 2026-08-27 15:04:53cloudlinux2 fail2ban: 2026-08-27 15:05:15,080 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 34.181.170.61 - 2026-08-27 15:05:14cloudlinux2 fail2ban: 2026-08-27 15:05:30,866 fail2ban.filter [1775]: INFO [plesk-wordpress] Found 67.223.118.121 - 2026-08-27 15:05:30cloudlinux2 fail2ban: 2026-08-27 15:05:47,751 fail2ban.filter [1775]: INFO [plesk-wordpress] Found 69.57.162.82 - 2026-08-27 15:05:47cloudlinux2 fail2ban: 2026-08-27 15:05:52,085 fail2ban.actions [1775]: NOTICE [plesk-modsecurity] Unban 34.30.200.241cloudlinux2 fail2ban: 2026-08-27 15:06:02,109 fail2ban.actions [1775]: NOTICE [plesk-modsecurity] Unban 49.47.129.152cloudlinux2 fail2ban: 2026-08-27 15:06:21 show less	Web App Attack
🇯🇵 warudora	2026-08-27 12:35:28 (20 hours ago)	Automated Honeypot Trap: Attempted to access sensitive path '/.env' on a Flask server.	Hacking Web App Attack
🇳🇱 Roderic	2026-08-27 12:24:54 (20 hours ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇺🇸 TPI-Abuse	2026-08-27 11:11:48 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 07:11:43.827594 2026] [security2:error] [pid 1810:tid 1810] [client 129.146.127.63:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.org"] [uri "/.env"] [unique_id "apAbb-7MchSU2HDtymSM2wAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Major Hostility	2026-08-26 21:55:47 (1 day ago)	"GET /.env HTTP/1.1" 404 "GET /.env HTTP/1.1" 404	Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 21:45:40 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 17:45:33.388876 2026] [security2:error] [pid 4318:tid 4318] [client 129.146.127.63:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cloudex.click"] [uri "/.env"] [unique_id "ao9efVZYzVt532SyWxlnoQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-08-26 21:00:35 (1 day ago)	gie-17 : Block hidden directories=>/.env(/)	Hacking
Anonymous	2026-08-26 20:41:47 (1 day ago)	129.146.127.63 - - [27/Aug/2026:04:41:46 +0800] "GET /.env HTTP/1.1" 200 19012 "-" "python-requests/ ... show more 129.146.127.63 - - [27/Aug/2026:04:41:46 +0800] "GET /.env HTTP/1.1" 200 19012 "-" "python-requests/2.34.2" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 17:29:50 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 129.146.127.63 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 13:29:45.405956 2026] [security2:error] [pid 2796:tid 2796] [client 129.146.127.63:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haywardcarpentry.com"] [uri "/.env"] [unique_id "ao8iiYfStw1KsdqkeCqiDgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 sefinek.net	2026-08-26 17:26:27 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (POST) \| Endpo ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (POST) \| Endpoint: / \| UA: python-requests/2.34.2 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-08-26 10:27:02 (1 day ago)	(apache-useragents) Failed apache-useragents trigger with match [python-requests/2.34.2] from 129.14 ... show more (apache-useragents) Failed apache-useragents trigger with match [python-requests/2.34.2] from 129.146.127.63 (US/United States/-): 5 in the last 300 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 129.146.127.63 - - [26/Aug/2026:12:26:49 +0200] "GET / HTTP/1.1" 200 39313 "-" "python-requests/2.34.2" 129.146.127.63 - - [26/Aug/2026:12:26:52 +0200] "GET /wp-content/themes/flatsome/assets/js/chunk.vendors-popups.947eca5c.js.map HTTP/1.1" 404 27909 "-" "python-requests/2.34.2" 129.146.127.63 - - [26/Aug/2026:12:26:55 +0200] "GET /gtm.js HTTP/1.1" 404 27807 "-" "python-requests/2.34.2" 129.146.127.63 - - [26/Aug/2026:12:26:58 +0200] "GET /wp-content/themes/flatsome/assets/js/chunk.tooltips.29144c1c.js.map HTTP/1.1" 404 27897 "-" "python-requests/2.34.2" 129.146.127.63 - - [26/Aug/2026:12:27:01 +0200] "GET /wp-content/themes/flatsome/assets/js/chunk.countup.fe2c1016.js HTTP/1.1" 200 6495 "-" "python-requests/2.34.2" show less	Port Scan
Anonymous	2026-08-26 00:44:21 (2 days ago)	Automated honeypot detection on bbd.fan: probed /.env \| UA: python-requests/2.34.2	Web App Attack Hacking

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 91.230.168.232

🇦🇿 82.194.21.139

🇵🇭 61.28.144.154

🇸🇪 2a01:111:f403:c202::7

🇮🇩 202.67.45.38

🇮🇩 202.65.225.100

🇦🇷 201.177.94.213

🇬🇧 194.50.235.152

🇨🇱 179.60.70.94

172.26.114.176

🇰🇷 121.1.81.95

🇺🇸 107.173.160.165

🇳🇵 103.134.217.35

🇲🇽 98.97.179.76

🇷🇴 92.118.39.212

🇭🇺 78.131.55.217

🇹🇷 45.11.200.125

🇩🇪 5.187.1.239

🇺🇸 2400:cb00:988:1000:6b59:aaf5:6995:f3c

🇦🇷 186.128.155.14