JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 5.161.205.129

5.161.205.129 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 21%: ?

21%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213230
Hostname(s)	static.129.205.161.5.clients.your-server.de
Domain Name	hetzner.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 5.161.205.129

Whois 5.161.205.129

IP Abuse Reports for 5.161.205.129:

This IP address has been reported a total of 10 times from 5 distinct sources. 5.161.205.129 was first reported on June 19th 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-06-26 09:43:31 (3 weeks ago)	[FriJun2611:43:27.8534652026][security2:error][pid2950856:tid2950864][client5.161.205.129:0]ModSecur ... show more [FriJun2611:43:27.8534652026][security2:error][pid2950856:tid2950864][client5.161.205.129:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"royalhosting.ch\"][uri\"/\"][unique_id\"aj5Jv8WgT28xs12GrxfLxAAAAQE\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 4server	2026-06-25 09:52:36 (4 weeks ago)	[ThuJun2511:52:30.0352852026][security2:error][pid2819557:tid2819692][client5.161.205.129:0]ModSecur ... show more [ThuJun2511:52:30.0352852026][security2:error][pid2819557:tid2819692][client5.161.205.129:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"shadowdrummer.com\"][uri\"/\"][unique_id\"ajz6XhIj_n2MezVpDVuX1wAAAMU\"] show less	Hacking Web App Attack
🇬🇷 setupgr	2026-06-23 19:23:52 (1 month ago)	(mod_security) mod_security (id:11000011) triggered by 5.161.205.129 (US/United States/Virginia/Ashb ... show more (mod_security) mod_security (id:11000011) triggered by 5.161.205.129 (US/United States/Virginia/Ashburn/-/[AS213230 HETZNER-CLOUD2-AS]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jun 23 22:23:51.110584 2026] [security2:error] [pid 1934718:tid 1934887] [client 5.161.205.129:57160] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "131"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.129.205.161.5.clients.your-server.de"] [severity "CRITICAL"] [hostname "doityourself.gr"] [uri "/"] [unique_id "ajrdR559dcPKThU2ezBjcAAAANE"] show less	Port Scan
🇵🇱 Ma ma	2026-06-23 04:20:00 (1 month ago)	page scanning	Web App Attack
🇩🇪 4server	2026-06-21 20:50:09 (1 month ago)	[SunJun2122:50:05.9278912026][security2:error][pid961248:tid961257][client5.161.205.129:0]ModSecurit ... show more [SunJun2122:50:05.9278912026][security2:error][pid961248:tid961257][client5.161.205.129:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"immobiliaretrentino.it\"][uri\"/\"][unique_id\"ajhOfREDcpGPBZq8EgkDxQAAAEY\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 4server	2026-06-21 17:38:02 (1 month ago)	[SunJun2119:37:59.0108232026][security2:error][pid1790441:tid1790463][client5.161.205.129:0]ModSecur ... show more [SunJun2119:37:59.0108232026][security2:error][pid1790441:tid1790463][client5.161.205.129:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"xn--tirascarph-ieb.ch\"][uri\"/\"][unique_id\"ajghdgZYrEr0ZoC2-UbWSgAAABQ\"] show less	Hacking Web App Attack
🇵🇱 sefinek.net	2026-06-21 14:29:27 (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (G ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (GET) \| Endpoint: / \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.76 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇷 setupgr	2026-06-19 23:36:36 (1 month ago)	(mod_security) mod_security (id:11000011) triggered by 5.161.205.129 (US/United States/Virginia/Ashb ... show more (mod_security) mod_security (id:11000011) triggered by 5.161.205.129 (US/United States/Virginia/Ashburn/-/[AS213230 HETZNER-CLOUD2-AS]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Jun 20 02:36:33.575426 2026] [security2:error] [pid 79894:tid 79930] [client 5.161.205.129:36412] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "131"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.129.205.161.5.clients.your-server.de"] [severity "CRITICAL"] [hostname "villa-izabela.com"] [uri "/"] [unique_id "ajXSgSc2acK9dyAMRdI9MAAAAUk"] show less	Port Scan
🇩🇪 4server	2026-06-19 19:26:11 (1 month ago)	[FriJun1921:26:07.8107102026][security2:error][pid2406918:tid2406981][client5.161.205.129:0]ModSecur ... show more [FriJun1921:26:07.8107102026][security2:error][pid2406918:tid2406981][client5.161.205.129:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"robertselitrenny.ch\"][uri\"/\"][unique_id\"ajWXz45-1gPvLRbirtD0MAAAAII\"] show less	Port Scan Brute-Force Web App Attack
🇷🇺 DZBOT	2026-06-19 04:32:35 (1 month ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a09:bac5:2f1d:18fa::27d:11d

🇩🇪 2a09:bac5:2f1b:18f0::27c:7

🇩🇪 2a09:bac1:1e00:12d8::27d:105

🇬🇧 217.154.45.93

🇬🇧 193.176.29.8

🇳🇱 185.242.226.126

🇨🇳 115.190.213.72

🇨🇳 111.47.243.219

🇹🇼 101.13.6.91

🇺🇸 45.92.229.27

🇹🇳 41.224.62.206

🇧🇪 35.189.233.157

🇧🇪 34.14.32.228

🇺🇸 13.86.105.235

🇩🇪 2a09:bac5:2f1d:2496::3a5:3f

🇩🇪 2a09:bac5:2f1b:1b4b::2b8:ec

🇩🇪 2a09:bac5:2f1a:2c8::47:62c

🇩🇪 2a09:bac5:2f19:2c8::47:5bc

🇩🇪 2a09:bac1:1e40:12d8::27c:75

🇺🇸 216.73.217.110