Extreme Threat
IP 130.12.180.70 is a critical-risk address operated by Omegatech LTD (ASN AS202412) that has been classified as an exploited host, indicating the system has been compromised and is being weaponized by threat actors to conduct automated attacks without the owner's knowledge. With a threat level of 10 out of 10 and 447 total abuse reports submitted across 20 automated honeypot sensors, this IP represents an active and dangerous compromised asset that should be immediately blocked at the network perimeter. The dominant threat profile involves malware and exploit activity consistent with the host being used as a staging point or attack platform, posing direct risk to any exposed service it targets.
Analysis of the available telemetry reveals a concentrated abuse window during March 2026, with all 20 contributing honeypot sensors flagging identical Exploited Host activity within the same reporting period. The 447 aggregate reports indicate sustained malicious engagement originating from this single compromised endpoint, demonstrating persistent automated exploitation attempts rather than opportunistic scanning. While the confidence score of 72% leaves some room for uncertainty regarding attribution, the volume and consistency of automated sensor detections provide substantial corroboration. Geographic context places this activity within United States network infrastructure operated by Omegatech LTD, a hosting provider whose network has generated significant abuse telemetry over the documented timeframe.
An exploited host differs fundamentally from an attacker-operated infrastructure because the compromised machine's legitimate owner is unaware their system is participating in malicious activity, often making takedown coordination more complex. The malware and exploit patterns associated with this IP suggest it may be running automated exploitation toolkits, scanning scripts, or dropper malware that relay commands from an external threat actor. For any organization exposing services to the internet, an IP with this threat classification creates a concrete risk of secondary compromise through drive-by attacks, credential theft attempts, or exploitation of vulnerable application surfaces.
UA 
GB