JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.231.206.105

94.231.206.105 was found in our database!

This IP was reported 664 times. Confidence of Abuse is 100%: ?

100%

ISP	FR ONYPHE
Usage Type	Commercial
ASN	AS213412
Hostname(s)	zuniga.probe.onyphe.net
Domain Name	onyphe.io
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.231.206.105

Whois 94.231.206.105

IP Abuse Reports for 94.231.206.105:

This IP address has been reported a total of 664 times from 155 distinct sources. 94.231.206.105 was first reported on December 1st 2025, and the most recent report was 28 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇬 drewf.ink	2026-06-11 13:14:07 (28 minutes ago)	[13:14] Port scanning. Port(s) scanned: TCP/554	Port Scan
🇩🇪 anycast_ac	2026-06-11 12:21:11 (1 hour ago)	[mirai-detector honeypot] Inbound attack against our honeypot on tcp/2222 (ssh). Commands captured: ... show more [mirai-detector honeypot] Inbound attack against our honeypot on tcp/2222 (ssh). Commands captured: $ SSH-2.0-perlssh show less	DDoS Attack IoT Targeted Brute-Force
🇩🇪 genokrad	2026-06-11 07:47:26 (5 hours ago)	Direct ip access to website TCP 80/443, path "/favicon.ico" [Mozilla/5.0 (X11; Ubuntu; Linux x86_64; ... show more Direct ip access to website TCP 80/443, path "/favicon.ico" [Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101]. show less	Port Scan Web App Attack
🇺🇸 donarev419	2026-06-11 02:51:17 (10 hours ago)	Connection to port 888 with data transfer. Data preview: GET / HTTP/1.1 Host: 67.215.244.172:888 C ... show more Connection to port 888 with data transfer. Data preview: GET / HTTP/1.1 Host: 67.215.244.172:888 Connection: close User-Agent: Mozilla/5.0 (X11; Ubuntu; L show less	Port Scan Hacking
🇧🇷 diego	2026-06-11 02:35:20 (11 hours ago)	[probe-44-49] 2026-06-11 02:15:45, Client: 94.231.206.105, Protocol: 6, Unauthorized activity to HTT ... show more [probe-44-49] 2026-06-11 02:15:45, Client: 94.231.206.105, Protocol: 6, Unauthorized activity to HTTP: GET / show less	Web App Attack
🇲🇳 Public CSIRT/CC of Mongolia	2026-06-11 01:43:42 (11 hours ago)	Honeypot hit: Unauthorized traffic (616 bytes of payload); 55555 [1] TCP	Port Scan
🇩🇪 Admins@FBN	2026-06-11 00:30:21 (13 hours ago)	Threat Host blocked...	Hacking Web Spam Email Spam Port Scan
🇦🇹 keechi	2026-06-10 22:01:26 (15 hours ago)	2026-06-02T09:37:09.719461+02:00 nextcloudpi postfix/smtpd[2625943]: improper command pipelining aft ... show more 2026-06-02T09:37:09.719461+02:00 nextcloudpi postfix/smtpd[2625943]: improper command pipelining after CONNECT from zuniga.probe.onyphe.net[94.231.206.105]: EHLO 84.112.33.160\r\n ... show less	Brute-Force
🇬🇧 sandra361	2026-06-10 21:25:03 (16 hours ago)	Port scan detected: 11 attempts across 1 ports (8082). \| Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=94 ... show more Port scan detected: 11 attempts across 1 ports (8082). \| Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=94.231.206.105 LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=25632 DF PROTO=TCP SPT=38025 DPT=8082 WINDOW=64240 RES=0x00 SYN URGP=0 show less	Port Scan
🇧🇬 MazenHost	2026-06-10 12:36:47 (1 day ago)	1781095006 - 06/10/2026 15:36:46 Host: 94.231.206.105/94.231.206.105 Port: 2000 TCP Blocked ...	Port Scan
🇵🇱 sefinek.net	2026-06-10 06:03:17 (1 day ago)	Honeypot hit: Unauthorized traffic on 3306/mysqld Reported by: https://github.com/sefinek/T-Pot-To-A ... show more Honeypot hit: Unauthorized traffic on 3306/mysqld Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇺🇸 itsnixk	2026-06-09 11:36:07 (2 days ago)	(mod_security) mod_security (id:920350) triggered by 94.231.206.105 (CN/China/zuniga.probe.onyphe.ne ... show more (mod_security) mod_security (id:920350) triggered by 94.231.206.105 (CN/China/zuniga.probe.onyphe.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jun 09 07:36:04.629539 2026] [security2:error] [pid 116275:tid 116410] [client 94.231.206.105:47879] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.26.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aif6pFEKPemfxH-h2sozFgAAAHQ"] show less	Port Scan
🇦🇹 keechi	2026-06-08 22:01:27 (2 days ago)	2026-06-02T09:37:09.719461+02:00 nextcloudpi postfix/smtpd[2625943]: improper command pipelining aft ... show more 2026-06-02T09:37:09.719461+02:00 nextcloudpi postfix/smtpd[2625943]: improper command pipelining after CONNECT from zuniga.probe.onyphe.net[94.231.206.105]: EHLO 84.112.33.160\r\n ... show less	Brute-Force
🇺🇸 drewf.ink	2026-06-08 16:34:58 (2 days ago)	[16:34] Port scanning. Port(s) scanned: TCP/5432	Port Scan
🇺🇸 DiodeDave	2026-06-08 05:20:56 (3 days ago)	Attempted access after blacklisting	Email Spam

Showing 1 to 15 of 664 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 65.111.27.87

🇺🇸 20.80.83.86

🇩🇪 217.181.91.238

🇩🇪 209.50.183.115

🇻🇳 180.93.43.225

🇱🇹 141.98.9.39

🇮🇳 135.235.138.43

🇫🇷 104.253.219.211

🇺🇸 47.251.85.219

🇩🇪 45.3.54.146

🇩🇪 45.3.54.107

🇺🇸 45.3.37.192

🇩🇴 38.56.21.66

🇻🇳 14.225.217.138

🇩🇪 194.187.176.118

🇬🇧 193.163.125.181

🇨🇳 183.150.182.61

🇺🇸 172.110.223.97

🇺🇸 165.227.196.13

🇮🇳 139.59.58.140