JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

158.94.208.46

Neutral Activity

Abuse Confidence Score

0% Low Risk

38 reports

27 reporters · latest 11 months ago

ISP: MGN TEKNOLOJI ANONIM SIRKETI
Usage Type: Data Center/Web Hosting/Transit
ASN: AS6461
Domain Name: mgnteknoloji.com.tr
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

158.94.208.46 has been reported 38 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

38 from 27 distinct reporters

First reported

October 18th 2025

Most recent report

11 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Blexyel	2025-12-06 06:53:37 UTC · (11 months ago)	158.94.208.46 - - [06/Dec/2025:07:53:36 +0100] "GET /.git/config HTTP/1.1" 404 435 "-" "Mozilla/5.0" "share.fomx.gay" ...	Brute-Force Web App Attack
🇷🇺 DZBOT	2025-12-05 08:43:32 UTC · (11 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇸🇪 SkyDancer	2025-12-04 23:58:25 UTC · (11 months ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X).	Hacking Brute-Force
🇺🇸 myagent.site	2025-12-03 01:40:30 UTC · (11 months ago)	Blocking for trying to access an exploit file: //.env	Hacking
🇺🇸 myagent.site	2025-11-30 18:54:30 UTC · (11 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇺🇸 TPI-Abuse	2025-11-30 08:02:48 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 03:02:44.174040 2025] [security2:error] [pid 13325:tid 13325] [client 158.94.208.46:62199] M ... show more (mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 03:02:44.174040 2025] [security2:error] [pid 13325:tid 13325] [client 158.94.208.46:62199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerloft.com"] [uri "/.env"] [unique_id "aSv6JJPjD0o1MzrIBaZ3gAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-30 07:43:20 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 02:43:15.426909 2025] [security2:error] [pid 19560:tid 19560] [client 158.94.208.46:60109] M ... show more (mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 02:43:15.426909 2025] [security2:error] [pid 19560:tid 19560] [client 158.94.208.46:60109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bullsalerts.com"] [uri "/.env"] [unique_id "aSv1k_srmOeTIYuMJp0HTAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-30 06:49:51 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 01:49:48.431059 2025] [security2:error] [pid 25870:tid 25870] [client 158.94.208.46:54109] M ... show more (mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 30 01:49:48.431059 2025] [security2:error] [pid 25870:tid 25870] [client 158.94.208.46:54109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stinecapital.net"] [uri "/.env"] [unique_id "aSvpDEflxXsj1WceLuI8OgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-30 06:48:46 UTC · (11 months ago)	(mod_security) mod_security triggered on hostname [redacted] 158.94.208.46 (DE/Germany/-)	SQL Injection
Anonymous	2025-11-30 03:55:11 UTC · (11 months ago)	SuspiciousC2 Activity detected by FMBAD System 2025-11-30 06:55:11	Hacking Bad Web Bot Web App Attack
Anonymous	2025-11-30 02:55:11 UTC · (11 months ago)	SuspiciousC2 Activity detected by FMBAD System 2025-11-30 05:55:11	Hacking Bad Web Bot Web App Attack
🇧🇪 cmbplf	2025-11-30 02:30:52 UTC · (11 months ago)	230 requests with url.path *.env	Brute-Force Bad Web Bot
🇺🇸 Starburst SysOp Team	2025-11-30 01:52:32 UTC · (11 months ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-mnz6-3)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-11-30 01:10:36 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 29 20:10:30.466220 2025] [security2:error] [pid 18425:tid 18425] [client 158.94.208.46:62406] M ... show more (mod_security) mod_security (id:210492) triggered by 158.94.208.46 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 29 20:10:30.466220 2025] [security2:error] [pid 18425:tid 18425] [client 158.94.208.46:62406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "askthetarot.cards"] [uri "/.env"] [unique_id "aSuZhrnOrVc-zzRpooVifgAAAFE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 sthoyer.de	2025-11-19 05:00:33 UTC · (11 months ago)	Nov 19 06:00:22 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=158.94.208.46 DST=173.212.223.67 LEN=52 TOS=0x02 PREC=0x00 TTL=114 ID=23163 DF PROTO=TCP SPT=58209 DPT=3389 WINDOW=8192 RES=0x00 CWR ECE S ... show more Nov 19 06:00:22 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=158.94.208.46 DST=173.212.223.67 LEN=52 TOS=0x02 PREC=0x00 TTL=114 ID=23163 DF PROTO=TCP SPT=58209 DPT=3389 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 ... show less	Port Scan

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 39.98.59.210

🇳🇱 213.209.159.175

🇸🇮 195.80.150.134

🇨🇳 111.22.163.209

🇨🇳 42.84.7.6

🇺🇸 20.102.90.250

🇮🇹 213.109.192.5

🇫🇮 209.85.208.198

🇧🇷 200.217.143.7

🇮🇹 185.217.71.22

🇸🇬 134.185.81.61

🇨🇳 112.30.127.9

🇹🇳 196.238.80.148

🇬🇧 165.154.174.27

🇻🇳 165.99.16.17

🇫🇷 87.88.222.217

🇳🇱 45.144.212.194

🇧🇪 34.96.41.62

🇺🇸 185.198.240.84

🇺🇸 173.244.32.6