JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 212.227.21.213

212.227.21.213 was found in our database!

This IP was reported 138 times. Confidence of Abuse is 100%: ?

100%

ISP	IONOS SE
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8560
Hostname(s)	ip212-227-21-213.pbiaas.com
Domain Name	ionos.com
Country	🇩🇪 Germany
City	Darmstadt, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 212.227.21.213

Whois 212.227.21.213

IP Abuse Reports for 212.227.21.213:

This IP address has been reported a total of 138 times from 112 distinct sources. 212.227.21.213 was first reported on June 13th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2026-06-26 10:04:13 (6 hours ago)	37.665 requests from abuseipdb.com blacklisted IP (1yr8mos5d)	Brute-Force Bad Web Bot
🇳🇱 DrLex0	2026-06-26 09:41:46 (6 hours ago)	Poking for env files at high rate from utterly shitty AS 212.227.21.213 80 - [26/Jun/2026:09:41:46 ... show more Poking for env files at high rate from utterly shitty AS 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.production HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.dev HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.save HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.prod HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /backend/.env HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.bak HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.backup HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" 212.227.21.213 80 - [26/Jun/2026:09:41:46 +0000] "GET /.env.local HTTP/1.1" 404 2383 "-" "Mozilla/5.0 (compatible)" show less	DDoS Attack Brute-Force Bad Web Bot Web App Attack
🇺🇸 etu brutus	2026-06-26 03:01:27 (13 hours ago)	212.227.21.213 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
Anonymous	2026-06-26 02:27:56 (13 hours ago)	[Fri Jun 26 04:27:55.050085 2026] [access_compat:error] [pid 10375] [client 212.227.21.213:45160] AH ... show more [Fri Jun 26 04:27:55.050085 2026] [access_compat:error] [pid 10375] [client 212.227.21.213:45160] AH01797: client denied by server configuration: /var/www/html/.env [Fri Jun 26 04:27:55.757049 2026] [access_compat:error] [pid 10375] [client 212.227.21.213:45160] AH01797: client denied by server configuration: /var/www/html/.env.example [Fri Jun 26 04:27:55.901567 2026] [access_compat:error] [pid 10375] [client 212.227.21.213:45160] AH01797: client denied by server configuration: /var/www/html/.env.development ... show less	Web App Attack
🇩🇪 Melle	2026-06-26 02:14:51 (13 hours ago)	Blocked by CrowdSec \| Scenario: crowdsecurity/http-sensitive-files \| 212.227.21.213 triggered 5 even ... show more Blocked by CrowdSec \| Scenario: crowdsecurity/http-sensitive-files \| 212.227.21.213 triggered 5 events \| Detected: 2026-06-26T02:14:49.833488582Z show less	Web App Attack Hacking
Anonymous	2026-06-26 01:27:55 (14 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇩🇪 on-com	2026-06-26 01:13:41 (14 hours ago)	URL scan	Brute-Force Web App Attack
🇩🇪 Starburst SysOp Team	2026-06-26 00:58:50 (15 hours ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-nue6-1)	Hacking Bad Web Bot
Anonymous	2026-06-26 00:45:49 (15 hours ago)	[Fri Jun 26 02:45:48.743473 2026] [authz_core:error] [pid 24405] [client 212.227.21.213:45752] AH016 ... show more [Fri Jun 26 02:45:48.743473 2026] [authz_core:error] [pid 24405] [client 212.227.21.213:45752] AH01630: client denied by server configuration: /etc/httpd/htdocs [Fri Jun 26 02:45:48.744368 2026] [authz_core:error] [pid 24441] [client 212.227.21.213:45788] AH01630: client denied by server configuration: /etc/httpd/htdocs [Fri Jun 26 02:45:48.744585 2026] [authz_core:error] [pid 24401] [client 212.227.21.213:45764] AH01630: client denied by server configuration: /etc/httpd/htdocs ... show less	Web App Attack
🇩🇪 Dennis	2026-06-26 00:24:04 (15 hours ago)	212.227.21.213 has been banned for triggering http-probing (11 events over 5.912497682s).	Brute-Force Web App Attack
🇩🇪 Bedios GmbH	2026-06-26 00:09:05 (15 hours ago)	Login credentials theft attempt	Hacking
🇩🇪 SMi-Web	2026-06-25 23:49:49 (16 hours ago)	Blocked by firewall on hugin [9090/tcp] \| Rule: UFW \| SPT: 51267 \| TTL: 244 \| LEN: 40 \| TOS: 0x00 • ... show more Blocked by firewall on hugin [9090/tcp] \| Rule: UFW \| SPT: 51267 \| TTL: 244 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 centurion	2026-06-25 23:49:07 (16 hours ago)	Blocked by UFW on ns02 [8000/tcp] Source port: 51267 TTL: 246 Packet length: 40 TOS: 0x00 This repo ... show more Blocked by UFW on ns02 [8000/tcp] Source port: 51267 TTL: 246 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 NeverBehave	2026-06-25 22:25:04 (17 hours ago)	[fail2ban] service ocserv jail	Brute-Force Web App Attack
🇩🇪 ValtonTahiri	2026-06-25 16:40:29 (23 hours ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=212.227.21.213; proto=TCP; source_port=43123; target_port=8888; flags=SYN show less	Port Scan

Showing 1 to 15 of 138 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 45.190.158.131

🇳🇱 45.148.10.151

🇺🇸 185.243.5.56

🇳🇱 176.65.139.56

🇺🇸 152.232.123.96

🇫🇮 147.185.133.197

🇨🇭 209.99.184.156

🇬🇧 157.245.36.108

🇧🇩 114.130.85.36

🇺🇸 66.132.195.64

🇺🇸 64.62.197.241

🇳🇱 195.178.110.246

🇺🇸 172.234.218.22

🇨🇦 149.56.26.193

🇸🇬 118.194.233.253

🇺🇸 66.132.195.36

🇧🇷 205.210.31.134

🇳🇱 176.65.139.88

🇺🇸 162.216.150.204

🇨🇦 85.217.149.73