JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 158.94.211.212

158.94.211.212 was found in our database!

This IP was reported 384 times. Confidence of Abuse is 79%: ?

79%

ISP	OMEGATECH
Usage Type	Fixed Line ISP
ASN	AS202412
Domain Name	omegatech.sc
Country	🇺🇸 United States of America
City	New York City, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 158.94.211.212

Whois 158.94.211.212

IP Abuse Reports for 158.94.211.212:

This IP address has been reported a total of 384 times from 157 distinct sources. 158.94.211.212 was first reported on February 28th 2026, and the most recent report was 23 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 llighthunter	2026-08-20 14:10:42 (23 hours ago)	Aug 20 17:10:27 mail postfix/smtps/smtpd[31479]: lost connection after CONNECT from unknown[158.94.2 ... show more Aug 20 17:10:27 mail postfix/smtps/smtpd[31479]: lost connection after CONNECT from unknown[158.94.211.212] Aug 20 17:10:40 mail postfix/smtps/smtpd[31479]: lost connection after CONNECT from unknown[158.94.211.212] show less	Hacking SSH
🇬🇧 gigatech	2026-08-20 04:55:04 (1 day ago)	SMTP Login Attempt	Brute-Force
🇦🇺 electronico	2026-08-14 12:24:40 (1 week ago)	2026-08-14T23:20:06.024706+11:00 mail1 postfix/smtpd[974000]: lost connection after AUTH from unknow ... show more 2026-08-14T23:20:06.024706+11:00 mail1 postfix/smtpd[974000]: lost connection after AUTH from unknown[158.94.211.212] 2026-08-14T23:24:32.473708+11:00 mail1 postfix/smtpd[974170]: lost connection after AUTH from unknown[158.94.211.212] 2026-08-14T23:24:40.209063+11:00 mail1 postfix/smtpd[974230]: lost connection after AUTH from unknown[158.94.211.212] ... show less	Brute-Force Email Spam
🇩🇪 DEV-DNS	2026-08-13 10:52:27 (1 week ago)	(smtpauth) Failed SMTP AUTH login from 158.94.211.212 (NL/The Netherlands/South Holland/Rotterdam/-/ ... show more (smtpauth) Failed SMTP AUTH login from 158.94.211.212 (NL/The Netherlands/South Holland/Rotterdam/-/[redacted]) show less	Brute-Force
🇵🇹 Subnet Shadow Specter	2026-08-12 07:04:29 (1 week ago)	[Activity Alert] Abusive automated scraping detected in violation of crawl depth limits. IP automati ... show more [Activity Alert] Abusive automated scraping detected in violation of crawl depth limits. IP automatically blocked and banned. [User-Agent]: python-requests/2.26.0. [OS]: Unknown. [IP Address]: 158.94.211.212. [IoA Datetime]: 2026-08-12 06:30:41 UTC +1. show less	Bad Web Bot Hacking Port Scan Web App Attack
🇧🇷 diego	2026-08-12 06:49:38 (1 week ago)	[rede-164-29] 08/12/2026-03:49:38.593764, 158.94.211.212, Protocol: 6, ET DROP Spamhaus DROP Listed ... show more [rede-164-29] 08/12/2026-03:49:38.593764, 158.94.211.212, Protocol: 6, ET DROP Spamhaus DROP Listed Traffic Inbound group 32 show less	Hacking
🇹🇼 ashiyasayo	2026-08-12 02:32:00 (1 week ago)	Detected phpunit remote code execution vulnerability.	Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 01:12:31 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2002:9e5e:d3d4::9e5e:d3d4 (Unknown): 1 in the l ... show more (mod_security) mod_security (id:210492) triggered by 2002:9e5e:d3d4::9e5e:d3d4 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 21:12:21.864169 2026] [security2:error] [pid 2959724:tid 2959724] [client 2002:9e5e:d3d4::9e5e:d3d4:20354] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thebradleyclinic.com"] [uri "/.env"] [unique_id "anvIdcRkRSfHd_q1-wWo-gAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-08-12 00:19:05 (1 week ago)	Probing for exploits 158.94.211.212 - - [12/Aug/2026:02:15:13 +0200] "GET //.env HTTP/1.1" 422 0 "-" ... show more Probing for exploits 158.94.211.212 - - [12/Aug/2026:02:15:13 +0200] "GET //.env HTTP/1.1" 422 0 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" 158.94.211.212 - - [12/Aug/2026:02:19:04 +0200] "GET //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 422 0 "-" "python-requests/2.26.0" show less	Hacking Web App Attack
🇩🇪 MusicLibrary	2026-08-11 23:42:10 (1 week ago)	Attempted access to sensitive configuration files (.env, .git, etc.)	Bad Web Bot Web App Attack
🇫🇷 tecnicorioja	2026-08-11 06:01:14 (1 week ago)	SASL LOGIN authentication failed Aug 11 06:51:02	Brute-Force
🇫🇷 tecnicorioja	2026-08-10 06:00:35 (1 week ago)	SASL LOGIN authentication failed Aug 10 06:50:26	Brute-Force
🇫🇷 tecnicorioja	2026-08-09 06:00:31 (1 week ago)	SASL LOGIN authentication failed Aug 09 06:49:46	Brute-Force
🇫🇷 tecnicorioja	2026-08-08 06:01:06 (1 week ago)	SASL LOGIN authentication failed Aug 08 06:48:49	Brute-Force
🇫🇷 tecnicorioja	2026-08-07 06:00:43 (2 weeks ago)	SASL LOGIN authentication failed Aug 07 06:48:05	Brute-Force

Showing 1 to 15 of 384 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 210.118.224.138

🇨🇳 182.88.7.124

🇫🇷 172.68.234.49

🇩🇪 167.172.168.90

🇺🇸 143.198.141.235

🇭🇰 123.58.213.128

🇺🇸 76.186.74.80

🇺🇸 98.93.248.22

🇩🇪 92.113.19.6

🇷🇴 81.181.129.252

🇻🇪 201.243.109.26

🇧🇷 189.27.74.36

🇮🇷 185.208.180.23

🇺🇦 176.103.15.169

🇺🇸 173.255.223.115

🇸🇬 172.253.211.21

🇺🇸 162.216.149.228

🇩🇪 139.19.117.197

🇹🇭 118.193.56.149

🇨🇳 101.43.22.57