JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.136.185.194

94.136.185.194 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 72%: ?

72%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS141995
Hostname(s)	vmi2595752.contaboserver.net
Domain Name	contabo.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.136.185.194

Whois 94.136.185.194

IP Abuse Reports for 94.136.185.194:

This IP address has been reported a total of 14 times from 12 distinct sources. 94.136.185.194 was first reported on September 14th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-09-16 21:08:32 (11 hours ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: /wp-json/gravitysmtp/v1/tests/mock-data \| 2026-09-16 21:08 UTC show less	Bad Web Bot
🇬🇧 consul.to	2026-09-16 14:37:57 (17 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 DocNetzwerk	2026-09-16 13:55:24 (18 hours ago)	94.136.185.194 (IN/India/vmi2595752.contaboserver.net), more than 7 Apache 403 hits	Hacking
🇩🇪 Tsumugi Kotobuki	2026-09-16 13:42:50 (18 hours ago)	Web Scan (L7) \| Paths: /index.php?[redacted-query] \| Codes: 444(1x) \| rDNS: vmi2595752.contaboserver ... show more Web Scan (L7) \| Paths: /index.php?[redacted-query] \| Codes: 444(1x) \| rDNS: vmi2595752.contaboserver.net \| F2B/angie-path-trap@2026-09-16T13:42:50Z show less	Web App Attack
Anonymous	2026-09-16 11:26:11 (21 hours ago)	IP matched detection query bad paths many.	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 05:31:18 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 94.136.185.194 (vmi2595752.contaboserver.net): ... show more (mod_security) mod_security (id:210492) triggered by 94.136.185.194 (vmi2595752.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 01:31:12.536041 2026] [security2:error] [pid 13506:tid 13506] [client 94.136.185.194:63144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fatcavestudios.fatcavemedia.com"] [uri "/wp-config.php.bak"] [unique_id "aqopoE_vu8p8NeKxlN9TEwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-16 02:59:18 (1 day ago)	URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ... show more URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-201) show less	Hacking
🇳🇱 Alt255	2026-09-16 01:49:24 (1 day ago)	[ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 94.136.185.194 - - [16/Sep/2026:03:49:01 +0200] "GET /db.sql HTTP/1.1" 404 31277 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-09-16 00:34:34 (1 day ago)	Blocked by ModSec and CSF	Port Scan
🇫🇮 paissangroup	2026-09-15 22:32:27 (1 day ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-09-15 20:06:23 (1 day ago)	Trying to access config files	Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 17:37:58 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 94.136.185.194 (vmi2595752.contaboserver.net): ... show more (mod_security) mod_security (id:210492) triggered by 94.136.185.194 (vmi2595752.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 13:37:52.827278 2026] [security2:error] [pid 20352:tid 20382] [client 94.136.185.194:23704] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.latinofederation.org"] [uri "/.git/config"] [unique_id "aqmCcP4S7wgWaMPJHW2paAAAAQM"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-09-15 15:35:03 (1 day ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-14 18:44:17 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 94.136.185.194 (vmi2595752.contaboserver.net): ... show more (mod_security) mod_security (id:210492) triggered by 94.136.185.194 (vmi2595752.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 14:44:11.989825 2026] [security2:error] [pid 2778:tid 2778] [client 94.136.185.194:46206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.asapstarsmogcheck.smogsandiego.com"] [uri "/.env"] [unique_id "aqhAewVZc_iytbUXvG7-AgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.194

🇦🇷 190.211.154.209

🇩🇪 185.220.101.45

🇧🇩 103.52.135.107

🇷🇴 2.57.122.150

🇺🇸 2001:470:1:332::77

🇻🇳 210.245.95.13

🇨🇳 193.112.192.91

🇫🇮 185.225.203.84

🇻🇳 157.66.225.224

🇺🇸 136.107.196.53

🇫🇷 85.217.140.35

🇵🇸 46.253.91.57

🇮🇹 34.154.184.232

🇫🇷 2001:41d0:269:4200::

🇺🇸 2001:470:1:c84::217

🇸🇦 167.86.170.172

🇵🇱 109.207.70.211

🇺🇸 72.202.225.82

🇦🇷 45.168.193.221