JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 95.216.142.212

95.216.142.212 was found in our database!

This IP was reported 54 times. Confidence of Abuse is 100%: ?

100%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	static.212.142.216.95.clients.your-server.de
Domain Name	hetzner.com
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 95.216.142.212

Whois 95.216.142.212

IP Abuse Reports for 95.216.142.212:

This IP address has been reported a total of 54 times from 47 distinct sources. 95.216.142.212 was first reported on September 16th 2026, and the most recent report was 59 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 andypiper	2026-09-17 01:00:54 (59 minutes ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 00:58:14 (1 hour ago)	(mod_security) mod_security (id:210492) triggered by 95.216.142.212 (static.212.142.216.95.clients.y ... show more (mod_security) mod_security (id:210492) triggered by 95.216.142.212 (static.212.142.216.95.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 20:58:07.757328 2026] [security2:error] [pid 640398:tid 640398] [client 95.216.142.212:10646] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.184"] [uri "/media../.env"] [unique_id "aqs7H5p-zfYuFYEfiv2xtwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 robotstxt	2026-09-17 00:51:13 (1 hour ago)	95.216.142.212 - - [17/Sep/2026:00:51:10 +0000] "GET /.azure/credentials HTTP/1.1" 400 291 "-" "Mozi ... show more 95.216.142.212 - - [17/Sep/2026:00:51:10 +0000] "GET /.azure/credentials HTTP/1.1" 400 291 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.2) Gecko/20100101 Firefox/121.2; compatible; Claude-User/1.0; [email protected]" "-" edge="95.216.142.212" 95.216.142.212 - - [17/Sep/2026:00:51:10 +0000] "GET /static../.azure/credentials HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected]) Chrome/148.0.800.4 Safari/537.36" "-" edge="95.216.142.212" 95.216.142.212 - - [17/Sep/2026:00:51:10 +0000] "GET /media../etc/passwd HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.5089.133 Safari/537.36; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user" "-" edge="95.216.142.212" 95.216.142.212 - - [17/Sep/2026:00:51:11 +0000] "GET /@fs/proc/self/environ HTTP/1.1" 400 693 "-" "Mozilla/5.0 (iPhone; CPU ... show less	Web Spam Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 00:38:35 (1 hour ago)	(mod_security) mod_security (id:210492) triggered by 95.216.142.212 (static.212.142.216.95.clients.y ... show more (mod_security) mod_security (id:210492) triggered by 95.216.142.212 (static.212.142.216.95.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 20:38:29.026178 2026] [security2:error] [pid 6308:tid 6308] [client 95.216.142.212:25494] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.41"] [uri "/static../.env"] [unique_id "aqs2hSTgUADyakqZSiY54QAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 robotstxt	2026-09-17 00:32:09 (1 hour ago)	95.216.142.212 - - [17/Sep/2026:00:32:04 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 693 "-" "Mozil ... show more 95.216.142.212 - - [17/Sep/2026:00:32:04 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.2419.206 Safari/537.36; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user" "-" edge="95.216.142.212" 95.216.142.212 - - [17/Sep/2026:00:32:05 +0000] "GET /.azure/credentials HTTP/1.1" 400 693 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.7941.224 Safari/537.36; compatible; ChatGPT-User/1.0; +https://openai.com/bot" "-" edge="95.216.142.212" 95.216.142.212 - - [17/Sep/2026:00:32:05 +0000] "GET /static../.azure/credentials HTTP/1.1" 400 291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:150.19) Gecko/20100101 Firefox/150.19; compatible; GPTBot/1.4; +https://openai.com/gptbot" "-" edge="95.216.142.212" 95.216.142.212 - - [17/Sep/2026:00:32:06 +0000] "GET /media../etc/passwd HTTP/1.1" 400 291 "-" "Mozilla/5.0 (Macintosh; Inte ... show less	Web Spam Web App Attack
🇫🇷 Lunix	2026-09-17 00:15:24 (1 hour ago)		Brute-Force Web App Attack
🇫🇷 EvoX	2026-09-17 00:06:00 (1 hour ago)	🛡️ Honeypot [bsts-tpot-hive]: HTTP/1.1 request on 8000 GET / User-Agent: Mozilla/5.0 (X11; Ubuntu; ... show more 🛡️ Honeypot [bsts-tpot-hive]: HTTP/1.1 request on 8000 GET / User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.7) Gecko/20100101 Firefox/105.7; compatible; TelegramBot/1.0 Accept-Encoding: gzip; 8000 [2] TCP show less	Hacking Bad Web Bot
🇪🇸 robotstxt	2026-09-16 23:52:59 (2 hours ago)	95.216.142.212 - - [16/Sep/2026:23:52:56 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 693 "-" "Mozil ... show more 95.216.142.212 - - [16/Sep/2026:23:52:56 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user) Chrome/131.0.6742.28 Safari/537.36" "-" edge="95.216.142.212" 95.216.142.212 - - [16/Sep/2026:23:52:56 +0000] "GET /static../.azure/credentials HTTP/1.1" 400 291 "-" "Mozilla/5.0 (Windows NT 10.0; rv:128.18) Gecko/20100101 Firefox/128.18; compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot" "-" edge="95.216.142.212" 95.216.142.212 - - [16/Sep/2026:23:52:56 +0000] "GET /static../.aws/credentials HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +https://www.anthropic.com/claude-searchbot) Chrome/124.0.133.30 Safari/537.36" "-" edge="95.216.142.212" 95.216.142.212 - - [16/Sep/2026:23:52:56 +0000] "GET /media../.env HTTP/ ... show less	Web Spam Web App Attack
🇫🇷 ingroscart.it	2026-09-16 23:37:06 (2 hours ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted])	Port Scan
🇳🇿 littlebots	2026-09-16 23:34:17 (2 hours ago)	FortiGate IPS: 78 intrusion attempts detected. Attacks: Vite.server.fs.deny.raw.Arbitrary.File.Read, ... show more FortiGate IPS: 78 intrusion attempts detected. Attacks: Vite.server.fs.deny.raw.Arbitrary.File.Read, Web.Server.Password.File.Access, Generic.Path.Traversal.Detection (+more). Targeted 1 host(s) across 1 firewall(s). Severity: alert. Period: 6h. show less	Hacking Web App Attack
🇩🇪 YF	2026-09-16 23:30:16 (2 hours ago)	Distributed subnet attack — coordinated scanning from multiple IPs in the same /24	DDoS Attack Web App Attack
🇺🇸 jormaster3k	2026-09-16 23:11:18 (2 hours ago)	Attack against Apache (too many 404s)	Web App Attack
Anonymous	2026-09-16 22:43:54 (3 hours ago)	[Thu Sep 17 00:43:53.473081 2026] [access_compat:error] [pid 721617:tid 721617] [client 95.216.142.2 ... show more [Thu Sep 17 00:43:53.473081 2026] [access_compat:error] [pid 721617:tid 721617] [client 95.216.142.212:44526] AH01797: client denied by server configuration: /var/www/html/media.. [Thu Sep 17 00:43:53.687204 2026] [access_compat:error] [pid 721618:tid 721618] [client 95.216.142.212:44546] AH01797: client denied by server configuration: /var/www/html/@fs ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-16 22:43:53 (3 hours ago)	[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 95.216.142.212 - - [17/Sep/2026:00:43:53 +0200] "GET /static../.env HTTP/1.1" 404 2637 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.6489.216 Safari/537.36 Edg/136.0.6489.216; compatible; Claude-User/1.0; [email protected]" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-09-16 22:41:02 (3 hours ago)	$f2bV_matches	Brute-Force Web App Attack

Showing 1 to 15 of 54 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.75

🇷🇺 209.142.100.37

🇧🇷 205.210.31.185

🇺🇸 198.13.238.242

🇬🇧 188.240.59.36

🇧🇴 181.115.138.50

🇺🇸 167.234.115.99

🇺🇸 162.216.149.9

🇺🇸 104.196.99.20

🇫🇷 91.196.152.218

🇫🇷 91.196.152.188

🇺🇸 89.39.214.199

🇺🇸 85.89.222.149

🇺🇸 47.37.130.147

🇬🇧 35.203.211.254

🇬🇧 35.203.211.170

🇸🇬 8.219.69.35

🇺🇸 209.207.184.132

🇧🇷 177.37.85.92

🇬🇧 172.70.85.233