JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.94.19.246

130.94.19.246 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 83%: ?

83%

ISP	LIGHT NODE LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS154177
Domain Name	lightnode.com
Country	🇺🇸 United States of America
City	Washington, District of Columbia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.94.19.246

Whois 130.94.19.246

IP Abuse Reports for 130.94.19.246:

This IP address has been reported a total of 23 times from 15 distinct sources. 130.94.19.246 was first reported on July 5th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 boxed-it	2026-07-08 03:26:26 (4 days ago)	GET /config/config.yaml (Tarpitted for 1d15h8m28s, wasted 8.06MB)	Web App Attack
🇧🇪 boxed-it	2026-07-08 02:16:34 (4 days ago)	GET /.bash_history (Tarpitted for 1d15h8m28s, wasted 8.06MB)	Web App Attack
🇸🇬 Starburst SysOp Team	2026-07-06 23:20:38 (5 days ago)	Restricted File Access Attempt: AI Coding Assistant Artifact. Matched phrase ".cursor/" at REQUEST_F ... show more Restricted File Access Attempt: AI Coding Assistant Artifact. Matched phrase ".cursor/" at REQUEST_FILENAME. (930140-sin2-2) show less	Hacking
🇩🇪 4server	2026-07-06 23:19:52 (5 days ago)	[TueJul0701:19:37.5106672026][security2:error][pid597170:tid597290][client130.94.19.246:0]ModSecurit ... show more [TueJul0701:19:37.5106672026][security2:error][pid597170:tid597290][client130.94.19.246:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mail.wildpferde.ch\"][uri\"/.env.bak.1\"][unique_id\"akw4CcN9C29a9GTgZRKTtQAAAQs\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-06 23:15:44 (5 days ago)	Excessive multi-domain requests	Brute-Force
🇬🇧 OptimusGO	2026-07-06 21:10:49 (5 days ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-07-06 22:10:49 UTC Log evidence: 07/06/2026-22:10:47.998257 [] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 130.94.19.246:44120 -> 185.127.18.66:8088 07/06/2026-22:10:49.022407 [] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 130.94.19.246:44120 -> 185.127.18.66:8088 show less	Port Scan Brute-Force
🇫🇷 dynamix	2026-07-06 17:42:19 (5 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 16:35:23 (5 days ago)	(mod_security) mod_security (id:210730) triggered by 130.94.19.246 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 130.94.19.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 12:35:16.898542 2026] [security2:error] [pid 21242:tid 21242] [client 130.94.19.246:59304] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|garyandthegroove.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "garyandthegroove.com"] [uri "/.config/io.datasette.llm/logs.db"] [unique_id "akvZRNeNOcwAx_52BW9WbwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-06 16:29:44 (5 days ago)	Automated report (2026-07-06T12:29:44-04:00). Caught probing for unsecured configuration file.	Hacking Web App Attack
🇧🇪 boxed-it	2026-07-06 14:26:48 (5 days ago)	GET /config/.env (Tarpitted for 38m22s, wasted 135.0kB)	Web App Attack
🇩🇪 Nightreaver	2026-07-06 14:17:54 (5 days ago)	130.94.19.246 - - [06/Jul/2026:16:17:53 0200] "GET /.env.backup HTTP/1.1" 404 438 "-" "LLMLeak-RedT ... show more 130.94.19.246 - - [06/Jul/2026:16:17:53 0200] "GET /.env.backup HTTP/1.1" 404 438 "-" "LLMLeak-RedTeam/1.0 (authorized-scan)" 130.94.19.246 - - [06/Jul/2026:16:17:53 0200] "GET /google-cloud-key.json HTTP/1.1" 404 438 "-" "LLMLeak-RedTeam/1.0 (authorized-scan)" 130.94.19.246 - - [06/Jul/2026:16:17:53 0200] "GET /.gentle-ai/state.json HTTP/1.1" 404 438 "-" "LLMLeak-RedTeam/1.0 (authorized-scan)" 130.94.19.246 - - [06/Jul/2026:16:17:53 0200] "GET /.config/goose/secrets.yaml HTTP/1.1" 404 438 "-" "LLMLeak-RedTeam/1.0 (authorized-scan)" 130.94.19.246 - - [06/Jul/2026:16:17:53 0200] "GET /.env.old HTTP/1.1" 404 438 "-" "LLMLeak-RedTeam/1.0 (authorized-scan)"[...] show less	Bad Web Bot Web App Attack
🇲🇳 Public CSIRT/CC of Mongolia	2026-07-06 13:47:37 (5 days ago)	Honeypot hit: Incoming HTTP traffic on port 81	Web App Attack Bad Web Bot
🇲🇾 Rizzy	2026-07-06 13:28:34 (5 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 Starburst SysOp Team	2026-07-06 08:18:00 (5 days ago)	Restricted File Access Attempt. Matched phrase ".bash_" at REQUEST_FILENAME. (930130-mnz6-7)	Hacking Web App Attack
🇧🇪 cmbplf	2026-07-06 07:29:36 (5 days ago)	541 requests with url.path .env 432 requests with url.path .config/* 291 requests with url.path ... show more 541 requests with url.path .env 432 requests with url.path .config/* 291 requests with url.path credentials.json 181 requests with url.path /auth.json 180 requests with url.path config.yaml 145 requests with url.path config.json 144 requests with url.path .ssh/ 108 requests with url.path *secrets.yaml show less	Brute-Force Bad Web Bot

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 221.159.165.10

🇨🇭 209.99.189.177

🇰🇪 197.232.165.91

🇩🇪 194.88.98.118

🇧🇷 179.232.147.216

🇺🇸 150.107.38.168

🇦🇫 149.54.62.114

🇺🇸 108.234.75.6

🇲🇦 105.71.133.117

🇯🇵 92.113.142.203

🇺🇸 91.196.33.234

🇧🇪 34.79.97.136

🇳🇱 193.176.31.208

🇦🇴 193.163.125.109

🇧🇷 191.37.151.176

🇻🇪 190.204.207.241

🇵🇦 186.188.233.232

🇺🇸 104.28.233.73

🇬🇧 89.104.239.129

🇺🇸 66.132.224.18