JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 109.172.225.194

109.172.225.194 was found in our database!

This IP was reported 102 times. Confidence of Abuse is 90%: ?

90%

ISP	MAGTCION
Usage Type	Fixed Line ISP
ASN	AS16010
Domain Name	magticom.ge
Country	🇬🇪 Georgia
City	Tbilisi, Tbilisi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 109.172.225.194

Whois 109.172.225.194

IP Abuse Reports for 109.172.225.194:

This IP address has been reported a total of 102 times from 41 distinct sources. 109.172.225.194 was first reported on March 27th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-24 09:54:17 (14 hours ago)	(mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:54:10.188483 2026] [security2:error] [pid 3779022:tid 3779022] [client 109.172.225.194:35310] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.172.225.194 (+1 hits since last alert)\|travelwithjenniferb.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "travelwithjenniferb.com"] [uri "/xmlrpc.php"] [unique_id "amM2QmpSRe79hjd_TnhTMQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 09:24:42 (15 hours ago)	(mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:24:37.818192 2026] [security2:error] [pid 15986:tid 15986] [client 109.172.225.194:45419] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.172.225.194 (+1 hits since last alert)\|laecovillage.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "laecovillage.org"] [uri "/xmlrpc.php"] [unique_id "amMvVU2leyAMrNcdb4LzXAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 alferez	2026-07-24 00:41:24 (23 hours ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 15:45:38 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 11:45:29.425440 2026] [security2:error] [pid 854400:tid 854400] [client 109.172.225.194:36841] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.172.225.194 (+1 hits since last alert)\|famagustacyprus.eu\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "famagustacyprus.eu"] [uri "/xmlrpc.php"] [unique_id "amI3GYdPuQscvTfwMrdanAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 14:44:09 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 10:44:02.847899 2026] [security2:error] [pid 3319271:tid 3319334] [client 109.172.225.194:5899] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.172.225.194 (+1 hits since last alert)\|tomithai.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tomithai.com"] [uri "/xmlrpc.php"] [unique_id "amIoso1qh3VumfUpa6JFwwAAAVg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-23 08:10:31 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 04:10:25.475896 2026] [security2:error] [pid 2527176:tid 2527176] [client 109.172.225.194:52143] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.172.225.194 (+1 hits since last alert)\|hendersonhomes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "hendersonhomes.com"] [uri "/xmlrpc.php"] [unique_id "amHMcY0MlyB67MVPdPKO-AAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 applemooz	2026-07-22 16:48:03 (2 days ago)	WordPress XMLRPC Brute Force Attacks ...	Brute-Force Web App Attack
🇫🇷 dynamix	2026-07-22 10:44:04 (2 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇮🇹 CoreTech srl	2026-07-21 15:48:42 (3 days ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_server_contact	Hacking
Anonymous	2026-07-21 14:45:38 (3 days ago)	[redacted] 109.172.225.194 - - [21/Jul/2026:16:44:58 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" ... show more [redacted] 109.172.225.194 - - [21/Jul/2026:16:44:58 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" [redacted] 109.172.225.194 - - [21/Jul/2026:16:45:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 109.172.225.194 - - [21/Jul/2026:16:45:16 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)" [redacted] 109.172.225.194 - - [21/Jul/2026:16:45:27 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.1)" [redacted] 109.172.225.194 - - [21/Jul/2026:16:45:37 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" ... show less	Hacking Web App Attack
🇩🇪 ghostwarriors	2026-07-21 10:20:29 (3 days ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-21 10:03:03 (3 days ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-20 21:08:36 (4 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-20 14:32:12 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 109.172.225.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 10:32:05.048200 2026] [security2:error] [pid 454:tid 454] [client 109.172.225.194:8095] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 109.172.225.194 (+1 hits since last alert)\|feiz.church\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "feiz.church"] [uri "/xmlrpc.php"] [unique_id "al4xZUSDsf_PGOHTqOU08gAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 MM-bot	2026-07-20 08:57:31 (4 days ago)	URL-probe: HTTP/1.1 POST request on /xmlrpc.php (2026-07-20 10:57:31 UTC+2)	Web App Attack Hacking

Showing 1 to 15 of 102 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 106.13.190.191

🇩🇪 84.201.25.69

🇧🇪 198.235.24.166

🇵🇱 176.53.159.198

🇸🇦 175.110.217.249

🇰🇭 175.100.107.238

🇺🇸 162.216.150.135

🇺🇸 162.216.150.106

🇩🇪 162.19.250.18

🇸🇬 129.212.237.153

🇮🇳 103.241.45.120

🇺🇸 73.15.249.196

🇫🇷 51.254.103.32

🇨🇳 49.88.156.34

🇨🇳 49.72.111.25

🇳🇱 45.148.10.230

🇺🇸 45.33.105.76

🇬🇧 35.203.211.118

🇨🇦 24.207.66.154

🇻🇳 14.169.193.118