JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.12.180.126

130.12.180.126 was found in our database!

This IP was reported 159 times. Confidence of Abuse is 100%: ?

100%

ISP	Virtualine Technologies
Usage Type	Fixed Line ISP
ASN	AS202412
Domain Name	virtualine.org
Country	🇩🇪 Germany
City	Aachen, North Rhine-Westphalia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.12.180.126

Whois 130.12.180.126

IP Abuse Reports for 130.12.180.126:

This IP address has been reported a total of 159 times from 132 distinct sources. 130.12.180.126 was first reported on July 26th 2026, and the most recent report was 2 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 WizardsToolkit	2026-07-27 12:08:28 (2 minutes ago)	attempted to access /app/.env	Web App Attack
🇺🇸 Charlesiv	2026-07-27 12:04:06 (6 minutes ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 202412 (Omegatech LTD) P ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 202412 (Omegatech LTD) Protocol: HTTP/1.1 (GET method) Endpoint: /functions/.env Timestamp: 2026-07-27T10:49:08Z Ray ID: a21b136368a5ee38 UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 hbrks	2026-07-27 12:01:40 (9 minutes ago)	86 attack(s) detected, such as these: {"event":"web_block","ip":"130.12.180.126","host":"ctxsip.adal ... show more 86 attack(s) detected, such as these: {"event":"web_block","ip":"130.12.180.126","host":"ctxsip.adalta.info","request":"GET /functions/.env HTTP/2.0","user_agent":"","reason":"Status-404","timestamp":"2026-07-27T12:01:40 00:00","logentry":"ctxsip.adalta.info 130.12.180.126 - - [27/Jul/2026:14:01:40 0200] \"GET /functions/.env HTTP/2.0\" 404 555 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36\" \"-\""} * Report Details : https://p4u.xyz/B5NN2MU2GG3/1 IP Details *: https://p4u.xyz/B5NN2MU2GG3/2 show less	Web Spam Hacking Bad Web Bot
🇫🇷 largo-it.net	2026-07-27 11:55:15 (15 minutes ago)	Jul 27 13:55:08 vps-9f3cdc33 haproxy[2931572]: 130.12.180.126:10742 [27/Jul/2026:13:55:08.428] www_f ... show more Jul 27 13:55:08 vps-9f3cdc33 haproxy[2931572]: 130.12.180.126:10742 [27/Jul/2026:13:55:08.428] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/12/23 404 478 - - ---- 89/44/3/3/0 0/0 "GET https://finance.largo.fr/%2e%2e%2f%2eenv HTTP/2.0" Jul 27 13:55:10 vps-9f3cdc33 haproxy[2931572]: 130.12.180.126:10742 [27/Jul/2026:13:55:09.795] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/337/348 404 3252 - - ---- 89/44/1/1/0 0/0 "GET https://finance.largo.fr/env HTTP/2.0" Jul 27 13:55:11 vps-9f3cdc33 haproxy[2931572]: 130.12.180.126:10742 [27/Jul/2026:13:55:10.711] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/327/338 404 3252 - - ---- 89/44/1/1/0 0/0 "GET https://finance.largo.fr/config/.env HTTP/2.0" Jul 27 13:55:12 vps-9f3cdc33 haproxy[2931572]: 130.12.180.126:10742 [27/Jul/2026:13:55:11.926] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/342/353 404 3252 - - ---- 87/42/0/0/0 0/0 "GET https://finance.largo.fr/app/.env HTTP/2.0" Jul 27 13:55:13 vps-9f ... show less	Hacking Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-07-27 11:55:07 (15 minutes ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 130.12.180.126 (-): 2 in the last 36 ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 130.12.180.126 (-): 2 in the last 3600 secs show less	Web App Attack
🇩🇪 itsolon	2026-07-27 11:44:15 (26 minutes ago)	[27/Jul/2026:13:44:13 +0200] 178515265335.162778 130.12.180.126 19324 217.154.7.177 80 [27/Jul/2026: ... show more [27/Jul/2026:13:44:13 +0200] 178515265335.162778 130.12.180.126 19324 217.154.7.177 80 [27/Jul/2026:13:44:13 +0200] 178515265350.861237 130.12.180.126 19340 217.154.7.177 80 [27/Jul/2026:13:44:13 +0200] 178515265347.593744 130.12.180.126 0 217.154.7.177 443 [27/Jul/2026:13:44:14 +0200] 178515265462.323180 130.12.180.126 30396 217.154.7.177 443 [27/Jul/2026:13:44:14 +0200] 178515265487.243590 130.12.180.126 19358 217.154.7.177 80 ... show less	Port Scan Hacking Brute-Force Web App Attack
🇹🇭 thaizone.com	2026-07-27 11:31:29 (39 minutes ago)	Hacking attempts against websites (D1) #1	Web App Attack Hacking
Anonymous	2026-07-27 10:44:32 (1 hour ago)	git/env leak probe	Web App Attack
🇮🇹 ciccio diddo	2026-07-27 10:29:58 (1 hour ago)	High Burst multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇫🇷 Baking333	2026-07-27 10:27:31 (1 hour ago)	[redacted] 130.12.180.126 - - [27/Jul/2026:11:27:28 +0100] "GET /.env HTTP/1.1" 302 6773 0/103673 "- ... show more [redacted] 130.12.180.126 - - [27/Jul/2026:11:27:28 +0100] "GET /.env HTTP/1.1" 302 6773 0/103673 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://[redacted]) Chrome/124.0.0.0 Safari/537.36" [redacted] 130.12.180.126 - - [27/Jul/2026:11:27:29 +0100] "GET /.git/HEAD HTTP/1.1" 302 1554 0/54890 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://[redacted]) Chrome/124.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack
🇫🇷 largo-it.net	2026-07-27 10:10:23 (2 hours ago)	Jul 27 12:10:09 vps-9f3cdc33 haproxy[2904144]: 130.12.180.126:13128 [27/Jul/2026:12:10:09.078] www_f ... show more Jul 27 12:10:09 vps-9f3cdc33 haproxy[2904144]: 130.12.180.126:13128 [27/Jul/2026:12:10:09.078] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/11/22 404 479 - - ---- 109/54/3/3/0 0/0 "GET https://largo-finance.com/%2e%2e%2f%2eenv HTTP/2.0" Jul 27 12:10:10 vps-9f3cdc33 haproxy[2904144]: 130.12.180.126:13128 [27/Jul/2026:12:10:10.117] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/456/467 404 3252 - - ---- 111/58/8/8/0 0/0 "GET https://largo-finance.com/env HTTP/2.0" Jul 27 12:10:12 vps-9f3cdc33 haproxy[2904144]: 130.12.180.126:13128 [27/Jul/2026:12:10:11.525] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/1217/1228 404 3252 - - ---- 111/57/10/10/0 0/0 "GET https://largo-finance.com/config/.env HTTP/2.0" Jul 27 12:10:14 vps-9f3cdc33 haproxy[2904144]: 130.12.180.126:13128 [27/Jul/2026:12:10:14.555] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/421/432 404 3252 - - ---- 111/59/4/4/0 0/0 "GET https://largo-finance.com/app/.env HTTP/2.0" Jul 27 12: ... show less	Hacking Bad Web Bot Web App Attack
🇳🇴 Bots.go.to.hell	2026-07-27 09:58:54 (2 hours ago)	This IP was detected by CrowdSec triggering custom/ip-honeypot	Web App Attack Bad Web Bot
🇬🇧 foxxelabs	2026-07-27 09:20:45 (2 hours ago)	Automated report from FoxxeLabs Sentinel. Path probed: /.env \| Project: anseo \| Reason(s): Known exp ... show more Automated report from FoxxeLabs Sentinel. Path probed: /.env \| Project: anseo \| Reason(s): Known exploit path: /.env; AbuseIPDB score: 100/100 \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Inst show less	Web App Attack
🇩🇪 macrob	2026-07-27 09:17:26 (2 hours ago)	2026/07/27 09:17:23 [error] 4132117#4132117: 416589396 access forbidden by rule, client: 130.12.180 ... show more 2026/07/27 09:17:23 [error] 4132117#4132117: 416589396 access forbidden by rule, client: 130.12.180.126, server: vn.binixo.ph, request: "GET /.env HTTP/2.0", host: "vn.binixo.ph" 2026/07/27 09:17:24 [error] 4132117#4132117: 416589815 access forbidden by rule, client: 130.12.180.126, server: vn.binixo.ph, request: "GET /.git/HEAD HTTP/2.0", host: "vn.binixo.ph" 2026/07/27 09:17:25 [error] 4132114#4132114: 416589515 access forbidden by rule, client: 130.12.180.126, server: vn.binixo.ph, request: "GET /.env.backup HTTP/2.0", host: "vn.binixo.ph" ... show less	Web App Attack
🇵🇱 Jacqb	2026-07-27 09:14:28 (2 hours ago)	Adres potencjalnie niebezpieczny	Brute-Force Web App Attack Bad Web Bot

Showing 1 to 15 of 159 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 213.166.84.50

🇨🇳 113.57.186.177

🇲🇩 91.208.184.128

🇷🇺 62.249.157.21

🇬🇧 54.38.147.173

🇳🇱 51.158.205.203

🇨🇳 223.210.27.53

🇺🇸 195.184.76.188

🇺🇸 165.154.173.141

🇨🇦 15.223.235.61

🇮🇩 202.51.214.99

🇳🇱 195.178.110.30

🇧🇷 189.15.37.15

🇺🇸 172.252.13.101

🇺🇸 162.217.100.196

🇩🇪 104.28.193.116

🇮🇳 103.212.209.186

🇺🇸 66.132.186.165

🇨🇳 36.151.150.93

🇵🇱 176.53.159.198