JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.158.60.131

94.158.60.131 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 54%: ?

54%

ISP	IPLUS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS43060
Domain Name	comnet.uz
Country	🇺🇿 Uzbekistan
City	Tashkent, Tashkent

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.158.60.131

Whois 94.158.60.131

IP Abuse Reports for 94.158.60.131:

This IP address has been reported a total of 56 times from 34 distinct sources. 94.158.60.131 was first reported on June 10th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-04 09:33:34 (1 week ago)	(mod_security) mod_security (id:210350) triggered by 94.158.60.131 (131.nat-2.comnet.uz): 1 in the l ... show more (mod_security) mod_security (id:210350) triggered by 94.158.60.131 (131.nat-2.comnet.uz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 05:33:27.431521 2026] [security2:error] [pid 26534:tid 26534] [client 94.158.60.131:58866] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|wryemusings.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wryemusings.com"] [uri "/"] [unique_id "asIdZ-Q3trJP7pXcgP1wOwAAAAQ"], referer: https://linkbuildingmarketing.online/dir/expert-link-building-services-234653 show less	Brute-Force Bad Web Bot Web App Attack
🇷🇴 abuse_IP_reporter	2026-10-04 07:45:33 (1 week ago)	Oct 4 09:48:32 server UFW BLOCK SRC=94.158.60.131 DF PROTO=TCP SPT=2047	Port Scan
🇺🇸 bpolson	2026-10-03 22:59:02 (1 week ago)	WordPress Hacking/Scanning. (s1)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-29 15:45:52 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 94.158.60.131 (131.nat-2.comnet.uz): 1 in the l ... show more (mod_security) mod_security (id:210350) triggered by 94.158.60.131 (131.nat-2.comnet.uz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 11:45:45.023987 2026] [security2:error] [pid 13130:tid 13130] [client 94.158.60.131:14833] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|gulftelecom.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gulftelecom.com"] [uri "/"] [unique_id "arvdKdHS6yQeDPlgiXIqkwAAAAQ"], referer: https://bulkbacklinkreport.site/dir/professional-seo-backlinks-87194 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Zandro	2026-09-29 05:00:14 (2 weeks ago)	distributed harvester	DDoS Attack Bad Web Bot Exploited Host
🇨🇿 Countryman	2026-09-29 00:10:02 (2 weeks ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇺🇸 kosada.com	2026-09-25 22:56:49 (3 weeks ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?field ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?field_article_edition%5B504%5D=504&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bk=&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Btitle=&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bfield_article_date=&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bfield_article_date_1=&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bsort_by=search_api_relevance&amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bpage=3&amp%3Bamp%3Bamp%3Bamp%3Bf%5B0%5D=digest_key_terms%3A516&amp%3Bamp%3Bamp%3Bf%5B0%5D=digest_key_terms%3A329&amp%3Bamp%3Bf%5B0%5D=digest_key_terms%3A718&amp%3Bf%5B0%5D=digest_key_terms%3A360 (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-09-23 12:28:56 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-23 07:45:56 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-20 15:13:03 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-20 06:53:48 (3 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 Vegascosmetics	2026-09-17 17:29:35 (4 weeks ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: High Priority: %25252F show less	Hacking Exploited Host Web App Attack
🇺🇸 鬼影233	2026-09-17 15:20:26 (4 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇯🇵 jup10393	2026-09-04 06:18:00 (1 month ago)	2026-09-04 13:21:04.965337 rule 0/0(match): block in on em0: (tos 0x0, ttl 46, id 62833, offset 0, f ... show more 2026-09-04 13:21:04.965337 rule 0/0(match): block in on em0: (tos 0x0, ttl 46, id 62833, offset 0, flags [none], proto TCP (6), length 60) 94.158.60.131.64050 > ....22: Flags [S], cksum 0xb4a1 (correct), seq 2585334158, win 65535, options [mss 1452,sackOK,TS val 44295423 ecr 0,nop,wscale 6], length 0 show less	SSH
🇺🇸 donarev419	2026-09-04 03:45:01 (1 month ago)	Port scan detected on port 23 (connection without data transfer)	Port Scan

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 119.192.128.163

🇳🇱 193.47.62.187

🇲🇴 182.93.50.90

🇦🇷 181.46.39.99

🇳🇱 176.65.139.201

🇳🇱 172.70.47.12

🇳🇱 172.70.47.11

🇺🇸 162.216.150.184

🇺🇸 147.185.132.216

🇺🇸 144.225.6.182

🇨🇳 101.237.128.147

🇫🇷 91.231.89.77

🇺🇸 71.30.133.246

🇺🇸 66.132.224.23

🇺🇸 66.132.195.104

🇩🇴 45.172.152.74

🇺🇸 216.73.217.43

🇺🇸 205.210.31.103

🇪🇹 196.189.88.100

🇺🇸 185.228.72.128