JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

158.173.79.16

Recent Activity

Abuse Confidence Score

60% Elevated

28 reports

13 reporters · latest 22 hours ago

ISP: VPN Consumer Vilnius, Lithuania
Usage Type: Data Center/Web Hosting/Transit
ASN: AS61272
Domain Name: vpnconsumer.com
Country: 🇱🇹 Lithuania
City: Siauliai, Siauliai

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

28 from 13 distinct reporters

First reported

May 26th 2026

Most recent report

22 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 6 🇩🇪 Germany 4 🇬🇧 United Kingdom of Great Britain and Northern Ireland 2

Most common categories Web App Attack 16 Brute-Force 6 Bad Web Bot 6 Hacking 3

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-11-12 02:40:15 UTC · (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 21:40:08.266251 2026] [security2:error] [pid 12590:tid 12590] [client 158.173.79.16:62017] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 21:40:08.266251 2026] [security2:error] [pid 12590:tid 12590] [client 158.173.79.16:62017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.174"] [uri "/.env"] [unique_id "avUnCAIHINLAByu-x1MqVwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-12 02:05:49 UTC · (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 21:05:42.242147 2026] [security2:error] [pid 2720:tid 2720] [client 158.173.79.16:63787] Mod ... show more (mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 21:05:42.242147 2026] [security2:error] [pid 2720:tid 2720] [client 158.173.79.16:63787] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.101"] [uri "/.env"] [unique_id "avUe9p-FS2fUS-GdEHPQdwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-12 01:21:39 UTC · (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:21:34.130200 2026] [security2:error] [pid 18440:tid 18440] [client 158.173.79.16:21025] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 20:21:34.130200 2026] [security2:error] [pid 18440:tid 18440] [client 158.173.79.16:21025] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.9"] [uri "/.env"] [unique_id "avUUnibt4SGgUF_NrPbysAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 AutosOnShow	2026-11-12 01:21:05 UTC · (23 hours ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-11-12 01:20:21.622 \|	Web App Attack
🇦🇺 2000cn.com.au	2026-11-12 00:46:52 UTC · (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇮🇪 AutosOnShow	2026-11-12 00:40:06 UTC · (1 day ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-11-12 00:39:46.944 \|	Web App Attack
🇹🇷 Domainhizmetleri.com	2026-11-12 00:13:06 UTC · (1 day ago)	Source: DH Hunter (Honeypot) \| Reason: HTTP Probe (80/tcp)	Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 23:51:50 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:51:45.843073 2026] [security2:error] [pid 31423:tid 31474] [client 158.173.79.16:29645] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:51:45.843073 2026] [security2:error] [pid 31423:tid 31474] [client 158.173.79.16:29645] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.86"] [uri "/.env"] [unique_id "avT_kVB05SurOBTNdm4M-AAAAEE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-11 23:36:05 UTC · (1 day ago)	[blue.dsamoodle.de] httpd-config-scan: sites=global; logs=/var/log/nginx/access.log; samples=/.env	Hacking Web App Attack
🇩🇪 BlueWire Hosting	2026-11-11 23:30:23 UTC · (1 day ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇩🇪 Tamsy	2026-11-11 23:16:02 UTC · (1 day ago)	HTTPD - 4xx scan	Web App Attack
🇩🇪 webanyone	2026-11-11 23:05:16 UTC · (1 day ago)	Secret file probe \| method: GET \| path: /.env \| ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 23:02:05 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:01:58.539656 2026] [security2:error] [pid 21198:tid 21198] [client 158.173.79.16:37453] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:01:58.539656 2026] [security2:error] [pid 21198:tid 21198] [client 158.173.79.16:37453] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.39"] [uri "/.env"] [unique_id "avTz5qG_q69SW2fXdUvvYQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 22:42:16 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:42:12.334173 2026] [security2:error] [pid 4970:tid 4970] [client 158.173.79.16:61279] Mod ... show more (mod_security) mod_security (id:210492) triggered by 158.173.79.16 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:42:12.334173 2026] [security2:error] [pid 4970:tid 4970] [client 158.173.79.16:61279] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.120"] [uri "/.env"] [unique_id "avTvRF8L9rLLn_lATeCThwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-11-07 21:48:21 UTC · (5 days ago)	Web attack/malicious scanning detected	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 192.241.179.235

🇺🇸 192.177.155.132

🇧🇷 177.207.250.1

🇷🇺 176.77.9.242

🇮🇩 113.212.160.38

🇳🇱 89.21.67.171

🇧🇷 45.229.177.250

🇺🇸 209.209.57.135

🇺🇸 205.210.31.105

🇺🇸 205.210.31.9

🇧🇷 154.80.128.230

🇫🇮 147.185.133.108

🇰🇷 119.204.122.94

🇮🇳 117.250.70.29

🇮🇳 103.91.246.101

🇳🇱 86.38.187.136

🇸🇬 8.222.240.43

🇺🇸 216.180.246.225

🇳🇱 200.138.46.61

🇺🇸 195.63.4.98