JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

178.104.12.201

Neutral Activity

Abuse Confidence Score

0% Low Risk

30 reports

20 reporters · latest 2 months ago

ISP: Hetzner Online GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS24940
Hostname(s): static.201.12.104.178.clients.your-server.de
Domain Name: hetzner.com
Country: 🇩🇪 Germany
City: Nuremberg, Bavaria

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

178.104.12.201 has been reported 30 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

30 from 20 distinct reporters

First reported

August 27th 2026

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-06 21:59:04 UTC · (2 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-05.	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-09-05 22:00:39 UTC · (2 months ago)	Auto-ban: >3000 req/min op 2026-09-05	Web App Attack SSH Hacking
🇲🇾 Rizzy	2026-09-05 08:56:10 UTC · (2 months ago)	Multiple WAF Violations	Brute-Force Web App Attack
Anonymous	2026-09-05 08:50:02 UTC · (2 months ago)	Bot / scanning and/or hacking attempts: GET /wp-config.php~ HTTP/1.1, GET /.git/index HTTP/1.1, GET /.git/config HTTP/1.1, GET /.git/HEAD HTTP/1.1, POST /wp-json/batch/v1 HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.svn/entries HTTP/1.1, GET /com ... show more Bot / scanning and/or hacking attempts: GET /wp-config.php~ HTTP/1.1, GET /.git/index HTTP/1.1, GET /.git/config HTTP/1.1, GET /.git/HEAD HTTP/1.1, POST /wp-json/batch/v1 HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.svn/entries HTTP/1.1, GET /composer.json HTTP/1.1, GET /yarn.lock HTTP/1.1, GET /package.json HTTP/1.1, GET /.env.save HTTP/1.1, GET /error_log HTTP/1.1, GET /wp-content/uploads/debug.log HTTP/1.1, GET /wp-content/debug.log HTTP/1.1, GET /wp-config.php.orig HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.hg/store/00manifest.i HTTP/1.1, GET /package-lock.json HTTP/1.1, GET /error.log HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env HTTP/1.1, POST /?rest_route=/batch/v1 HTTP/1.1, GET /wp-config.php.txt HTTP/1.1, GET /composer.lock HTTP/1.1, GET /.env.swp HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-05 08:38:38 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 178.104.12.201 (static.201.12.104.178.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 04:38:30.536764 2026] [security2:error] [pid 872 ... show more (mod_security) mod_security (id:210492) triggered by 178.104.12.201 (static.201.12.104.178.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 04:38:30.536764 2026] [security2:error] [pid 8728:tid 8728] [client 178.104.12.201:44976] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prayers4america.com"] [uri "/wp-config.php.bak"] [unique_id "apvVBmDczqpG8e_ZQufKdAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 craudiovizai	2026-09-05 06:30:31 UTC · (2 months ago)	Automated honeypot detection. honeypot against a Next.js application. Paths: /.env, /.git/config. Blocked at the edge.	Web App Attack Bad Web Bot
🇬🇧 consul.to	2026-09-05 04:14:12 UTC · (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇪🇸 elcruzado.es	2026-09-05 01:53:14 UTC · (2 months ago)	(mod_security) mod_security triggered on hostname [redacted] 178.104.12.201 (DE/Germany/static.201.12.104.178.clients.your-server.de)	SQL Injection
🇺🇸 TPI-Abuse	2026-09-05 00:28:38 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 178.104.12.201 (static.201.12.104.178.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 20:28:30.679859 2026] [security2:error] [pid 242 ... show more (mod_security) mod_security (id:210492) triggered by 178.104.12.201 (static.201.12.104.178.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 20:28:30.679859 2026] [security2:error] [pid 24285:tid 24285] [client 178.104.12.201:35854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newhopepetgrooming.com"] [uri "/wp-config.php.swp"] [unique_id "aptiLhoku-1cNHf2AweHFgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-04 23:47:53 UTC · (2 months ago)	(caddyscan) Scanner path probe from 178.104.12.201 (DE/Germany/static.201.12.104.178.clients.your-server.de): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 178.104.12.201 - - [04/Sep/2026:23 ... show more (caddyscan) Scanner path probe from 178.104.12.201 (DE/Germany/static.201.12.104.178.clients.your-server.de): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 178.104.12.201 - - [04/Sep/2026:23:47:51 +0000] "GET /.env.dev HTTP/1.1" [REDACTED] 200 2627 178.104.12.201 - - [04/Sep/2026:23:47:51 +0000] "GET /.env.txt HTTP/1.1" [REDACTED] 200 2627 178.104.12.201 - - [04/Sep/2026:23:47:52 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 178.104.12.201 - - [04/Sep/2026:23:47:52 +0000] "GET /.env.staging HTTP/1.1" [REDACTED] 200 2627 178.104.12.201 - - [04/Sep/2026:23:47:52 +0000] "GET /.env.local HTTP/1.1" show less	Port Scan
Anonymous	2026-09-04 23:40:02 UTC · (2 months ago)	Blocked by os-abuseipdb; 14 hits, proto=tcp, ports=443,80	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-09-04 23:08:01 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 178.104.12.201 (static.201.12.104.178.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 19:07:57.065866 2026] [security2:error] [pid 829 ... show more (mod_security) mod_security (id:210492) triggered by 178.104.12.201 (static.201.12.104.178.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 19:07:57.065866 2026] [security2:error] [pid 8298:tid 8367] [client 178.104.12.201:50628] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.iamfluff.com"] [uri "/wp-config.php.save"] [unique_id "aptPTSdJYu0S8RePPKmnGgAAAMM"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-09-04 22:45:04 UTC · (2 months ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇷🇴 iulianh	2026-09-04 22:38:35 UTC · (2 months ago)	80,443	Brute-Force SSH
🇬🇧 thetomtaylor.co.uk	2026-09-04 21:57:01 UTC · (2 months ago)	Fail2Ban - [WAF]ModSecurity rule violation on modsecurity ... [mx01]	Hacking SQL Injection Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 195.178.110.228

🇺🇸 157.22.124.200

🇺🇦 94.178.192.251

🇳🇱 77.67.26.200

🇲🇽 187.161.135.111

🇬🇪 185.228.133.226

🇳🇱 185.136.15.16

🇺🇸 162.216.150.119

🇭🇰 152.32.133.103

🇨🇦 132.210.200.145

🇺🇸 132.145.131.173

🇧🇷 69.6.221.18

🇸🇬 43.172.196.68

🇫🇮 31.134.13.111

🇺🇸 2602:80d:1008::5b

🇪🇸 213.235.27.66

🇳🇱 193.47.62.69

🇺🇸 172.236.228.229

🇨🇿 95.129.243.47

🇵🇹 85.240.193.104