JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

45.130.202.4

Neutral Activity

Abuse Confidence Score

0% Low Risk

217 reports

74 reporters · latest 3 months ago

ISP: Legaco Networks B.V.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS137409
Domain Name: legaconetworks.nl
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

45.130.202.4 has been reported 217 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

217 from 74 distinct reporters

First reported

December 25th 2022

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 derekgallardo01	2026-08-05 06:01:27 UTC · (3 months ago)	Auto-reported by Worker: AiTM toolkit UA fingerprint CRITICAL: auto-add to BadIPS Named Location + report to AbuseIPDB.. Detection: AiTM toolkit UA fingerprint (Tycoon/EvilProxy portal-browser). Blocked at Conditional Access gate.	Brute-Force Web App Attack
🇺🇸 derekgallardo01	2026-07-30 17:16:21 UTC · (3 months ago)	Auto-reported by Worker: AiTM toolkit UA fingerprint CRITICAL: auto-add to BadIPS Named Location + report to AbuseIPDB.. Detection: AiTM toolkit UA fingerprint (Tycoon/EvilProxy portal-browser). Blocked at Conditional Access gate.	Brute-Force Web App Attack
🇺🇸 kosada.com	2026-07-28 17:40:17 UTC · (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇨🇭 Origon	2026-07-01 15:33:03 UTC · (4 months ago)	http-backdoors-attempts - IP: 45.130.202.4 - time="2026-07-01T17:33:02+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-backdoors-attempts by ip 45.130.202.4 (TR/137409) : 4h ban on Ip 45.130.202. ... show more http-backdoors-attempts - IP: 45.130.202.4 - time="2026-07-01T17:33:02+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-backdoors-attempts by ip 45.130.202.4 (TR/137409) : 4h ban on Ip 45.130.202.4" module=db show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 21:52:31 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 17:52:26.161685 2026] [security2:error] [pid 24933:tid 24960] [client 45.130.202.4:55585] Mod ... show more (mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 17:52:26.161685 2026] [security2:error] [pid 24933:tid 24960] [client 45.130.202.4:55585] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coloring.ajbruner.com"] [uri "/.env"] [unique_id "ai3RGqIH3RxiLRfUO4uBPQAAANg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 15:08:14 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 11:08:10.398603 2026] [security2:error] [pid 19245:tid 19245] [client 45.130.202.4:44323] Mod ... show more (mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 11:08:10.398603 2026] [security2:error] [pid 19245:tid 19245] [client 45.130.202.4:44323] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "physician.versacardio.com"] [uri "/.env.production"] [unique_id "ai1yWrDU_KuYlEvNZa5aogAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 10:24:06 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 06:23:59.813518 2026] [security2:error] [pid 3235:tid 3235] [client 45.130.202.4:61407] ModSe ... show more (mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 06:23:59.813518 2026] [security2:error] [pid 3235:tid 3235] [client 45.130.202.4:61407] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.clintcurrin.com"] [uri "/.git/HEAD"] [unique_id "ai0vv4ObUSMON51wPxgfZgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇴 jad-abuse	2026-06-13 04:38:11 UTC · (5 months ago)	ThreatFeed automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure. Observed by 1 sensor(s); 1 hits.	Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 18:48:22 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 14:48:17.125056 2026] [security2:error] [pid 321:tid 321] [client 45.130.202.4:41199] ModSecu ... show more (mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 14:48:17.125056 2026] [security2:error] [pid 321:tid 321] [client 45.130.202.4:41199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bigislandhawaiirealestate.com.kh6jim.com"] [uri "/.env.production"] [unique_id "aixUcQAkp1ZLwwWbTA-drwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-06-12 18:20:16 UTC · (5 months ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-12 10:39:54 UTC · (5 months ago)	Excessive multi-domain requests	Brute-Force
🇬🇧 consul.to	2026-06-12 09:45:47 UTC · (5 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 08:49:30 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 04:49:25.714576 2026] [security2:error] [pid 25753:tid 25753] [client 45.130.202.4:59037] Mod ... show more (mod_security) mod_security (id:210492) triggered by 45.130.202.4 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 04:49:25.714576 2026] [security2:error] [pid 25753:tid 25753] [client 45.130.202.4:59037] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "test.ketsuri.com"] [uri "/.git/HEAD"] [unique_id "aip2lX5FYYHU-sVCP-W_WwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-06-11 03:07:28 UTC · (5 months ago)	wp-login request blocked, no referer. Pattern match "wp-login.php" at REQUEST_URI. (5001900-122)	Web App Attack
🇫🇷 Octopuce	2026-06-10 14:32:50 UTC · (5 months ago)	Aggressive web search of vulnerable pages: /wp-content/themes/twentytwentythree/patterns/ /wp-admin/css/colors/sunrise/ /wp-includes/block-patt ...	Web App Attack

Showing 1 to 15 of 217 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 77.239.124.35

🇦🇪 74.243.250.30

🇺🇸 50.18.13.139

🇺🇸 45.79.153.72

🇸🇬 43.163.86.65

🇧🇪 35.210.99.213

🇦🇷 201.234.106.215

🇹🇳 197.26.40.55

🇺🇸 188.223.189.223

🇳🇱 185.184.222.78

🇮🇳 182.76.36.62

🇮🇳 103.109.13.50

🇮🇪 95.44.244.82

🇷🇴 92.118.39.14

🇺🇸 70.182.12.182

🇨🇳 59.37.13.66

🇲🇽 45.189.151.78

🇫🇮 45.133.114.18

🇺🇸 34.136.150.21

🇷🇺 31.132.169.138