JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

94.130.8.54

Neutral Activity

Abuse Confidence Score

0% Low Risk

56 reports

27 reporters · latest 6 months ago

ISP: Hetzner Online GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS24940
Hostname(s): prod-apps-worker-03.sr-srv.net
Domain Name: hetzner.com
Country: 🇩🇪 Germany
City: Falkenstein, Saxony

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

94.130.8.54 has been reported 56 times. The most recent report is from 6 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

56 from 27 distinct reporters

First reported

April 5th 2026

Most recent report

6 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-05-02 06:00:00 UTC · (6 months ago)	Confirmed malicious by STILWaters CTI platform (score=89, sources=1)	Hacking Brute-Force SSH
🇦🇱 router.al	2026-04-13 06:03:54 UTC · (7 months ago)	04/13/2026-06:03:54.288849 94.130.8.54 Protocol: 6 GPL WEB_SERVER 403 Forbidden	Port Scan
🇬🇧 andypiper	2026-04-13 01:00:51 UTC · (7 months ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇹🇷 Detmach	2026-04-13 00:00:20 UTC · (7 months ago)	Security attack detected. Multiple failed attempts from 94.130.8.54. IP banned for 1440 minutes at 13.04.2026 03:00:18. Failed attempts: 1	Brute-Force
🇬🇧 Smish	2026-04-12 22:03:22 UTC · (7 months ago)	HONEYPOT HIT --> Fail2ban time=1776031401 log=2026-04-12T23:03:21+01:00 ip=94.130.8.54 host=router.ham.as210667.net method=GET uri="/.git/HEAD" status=404 ua="Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Sa ... show more HONEYPOT HIT --> Fail2ban time=1776031401 log=2026-04-12T23:03:21+01:00 ip=94.130.8.54 host=router.ham.as210667.net method=GET uri="/.git/HEAD" status=404 ua="Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" ref="-" rid=7ff125d1d6f7f559dc6a21a22ec79839 show less	Web App Attack
🇦🇺 aranguren.org	2026-04-12 16:10:01 UTC · (7 months ago)	94.130.8.54 - - [13/Apr/2026:01:40:29 +1000] "GET /.git/objects/db/ HTTP/1.1" 200 986 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0" 94.130.8.54 - - [13/Apr/2026:01:40:38 +1000] "GET /.git/objects/db/27bde5638be56898afbbc471 ... show more 94.130.8.54 - - [13/Apr/2026:01:40:29 +1000] "GET /.git/objects/db/ HTTP/1.1" 200 986 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0" 94.130.8.54 - - [13/Apr/2026:01:40:38 +1000] "GET /.git/objects/db/27bde5638be56898afbbc4717c048ea22cf98f HTTP/1.1" 200 53 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0" 94.130.8.54 - - [13/Apr/2026:02:10:00 +1000] "GET /.git/info/ HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0" ... show less	Web App Attack
🇬🇧 Smish	2026-04-12 08:41:00 UTC · (7 months ago)	HONEYPOT HIT --> Fail2ban time=1775983259 log=2026-04-12T09:40:59+01:00 ip=94.130.8.54 host=ipam.as210667.net method=GET uri="/.git/HEAD" status=404 ua="Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/ ... show more HONEYPOT HIT --> Fail2ban time=1775983259 log=2026-04-12T09:40:59+01:00 ip=94.130.8.54 host=ipam.as210667.net method=GET uri="/.git/HEAD" status=404 ua="Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" ref="-" rid=5d6007fc58d5ca319f44985b022c1565 show less	Web App Attack
🇮🇹 Giaccaz	2026-04-12 08:00:08 UTC · (7 months ago)	Keenetic Firewall: Persistent traffic from Blacklisted IP. Blocked via Kernel/NFLOG. (32 hits in 24h).	Port Scan
🇺🇸 TPI-Abuse	2026-04-12 00:44:02 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 94.130.8.54 (static.54.8.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 20:43:54.832820 2026] [security2:error] [pid 3311242:t ... show more (mod_security) mod_security (id:210492) triggered by 94.130.8.54 (static.54.8.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 20:43:54.832820 2026] [security2:error] [pid 3311242:tid 3311242] [client 94.130.8.54:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "concealed.cloudex.click"] [uri "/.git/HEAD"] [unique_id "adrqyu65THZo1clyiz-sHAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Charlesiv	2026-04-10 14:25:34 UTC · (7 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 24940 (HETZNER-AS) Protocol: HTTP/1.1 (GET method) Endpoint: /.git/HEAD Timestamp: 2026-04-10T13:52:13Z Ray ID: 9ea23b151eaad3bd UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10 ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 24940 (HETZNER-AS) Protocol: HTTP/1.1 (GET method) Endpoint: /.git/HEAD Timestamp: 2026-04-10T13:52:13Z Ray ID: 9ea23b151eaad3bd UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2 rv:2.0; mai-IN) AppleWebKit/533.27.1 (KHTML, like Gecko) Version/5.0 Safari/533.27.1 show less	Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-04-10 12:30:00 UTC · (7 months ago)	(mod_security-custom) mod_security (id:210492) triggered by 94.130.8.54 (DE/Germany/Saxony/Falkenstein/static.54.8.130.94.clients.your-server.de/[AS24940 HETZNER-AS]): 1 in the last 3600 secs (0-srv1)	Hacking
🇩🇪 louis77	2026-04-10 05:01:46 UTC · (7 months ago)	Sensitive file access attempt - Path: /.git/HEAD, Method: GET, UA: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36	Web App Attack Hacking
🇨🇦 polycoda	2026-04-08 06:48:33 UTC · (7 months ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based)	Hacking Web App Attack
🇬🇧 pinguin	2026-04-08 06:38:23 UTC · (7 months ago)	Triggered Cloudflare WAF (firewallManaged) from DE. Action taken: LOG Protocol: HTTP/1.1 (GET method) Endpoint: /.git/HEAD UA: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 This report was ... show more Triggered Cloudflare WAF (firewallManaged) from DE. Action taken: LOG Protocol: HTTP/1.1 (GET method) Endpoint: /.git/HEAD UA: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-08 04:22:32 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 94.130.8.54 (static.54.8.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 00:22:25.226521 2026] [security2:error] [pid 1929125:t ... show more (mod_security) mod_security (id:210492) triggered by 94.130.8.54 (static.54.8.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 00:22:25.226521 2026] [security2:error] [pid 1929125:tid 1929125] [client 94.130.8.54:57596] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "parkgrant.com"] [uri "/.git/HEAD"] [unique_id "adXYARdxd_qyC53q2bwUWAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇷 177.174.89.99

🇺🇸 167.99.154.129

🇿🇦 165.255.13.71

🇺🇸 157.22.73.156

🇩🇿 154.242.143.104

🇺🇸 147.124.209.163

🇬🇧 144.126.235.189

🇨🇳 123.160.221.153

🇨🇳 117.39.45.196

🇨🇳 116.172.249.155

🇷🇺 95.165.84.70

🇳🇱 77.239.124.74

🇨🇴 64.76.8.21

🇺🇸 34.214.114.137

🇨🇴 8.243.73.199

🇲🇽 201.108.5.215

🇹🇳 197.17.28.163

🇧🇷 191.55.71.54

🇨🇴 190.61.61.206

🇹🇼 152.32.230.104