JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.104.11.201

194.104.11.201 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 11%: ?

11%

ISP	TrafficTransitSolution LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS26548
Domain Name	traffictransitsolution.us
Country	🇺🇸 United States of America
City	New York City, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.104.11.201

Whois 194.104.11.201

IP Abuse Reports for 194.104.11.201:

This IP address has been reported a total of 28 times from 19 distinct sources. 194.104.11.201 was first reported on May 28th 2021, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 BoosterGold2099	2026-08-25 22:21:21 (17 hours ago)		Hacking Exploited Host Web App Attack
🇫🇮 JimArchon72	2026-07-08 11:50:01 (1 month ago)	2026/07/08 11:49:30 "GET /wp-login.php HTTP/1.1"	Web App Attack
Anonymous	2026-06-30 05:33:08 (1 month ago)	Blocked by ModSec and CSF	Port Scan
🇬🇧 [email protected]	2026-06-24 00:28:01 (2 months ago)	194.104.11.201 - - [24/Jun/2026:00:27:50 +0000] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 206 "-" "M ... show more 194.104.11.201 - - [24/Jun/2026:00:27:50 +0000] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36" 194.104.11.201 - - [24/Jun/2026:00:27:54 +0000] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" 194.104.11.201 - - [24/Jun/2026:00:28:00 +0000] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" ... show less	Web App Attack
🇫🇷 SpaceHost-Server	2026-05-28 22:28:28 (2 months ago)		Brute-Force Web App Attack
🇫🇷 SpaceHost-Server	2026-05-27 22:27:25 (2 months ago)		Brute-Force Web App Attack
🇫🇷 Tilellit.PRO	2026-05-21 15:10:42 (3 months ago)	Fail2Ban banned 194.104.11.201 for security violations in jail wp-armour. Log: 2026/05/21 15:10:42 [ ... show more Fail2Ban banned 194.104.11.201 for security violations in jail wp-armour. Log: 2026/05/21 15:10:42 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 194.104.11.201 \| Target: wplogin" , client: 194.104.11.201, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
🇺🇸 TPI-Abuse	2026-05-08 20:25:57 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 16:25:50.975957 2026] [security2:error] [pid 20290:tid 20302] [client 194.104.11.201:39075] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|transitionalcareservices.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "transitionalcareservices.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af5Gzk8WZFtgU7QJYUPaHgAAAAE"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-27 23:24:55 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 19:24:49.174619 2026] [security2:error] [pid 4062:tid 4062] [client 194.104.11.201:15579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thestardance.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thestardance.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae_wQUdeFgqR-2j60qnYxAAAAAU"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 David Koswari	2026-04-20 06:20:00 (4 months ago)	REQ_BLOCKED_ACL	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted
🇩🇪 MusicLibrary	2026-04-16 10:13:18 (4 months ago)	Attempted access to non existent wordpress urls	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-20 02:18:13 (5 months ago)	(mod_security) mod_security (id:210350) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:17:50.561279 2026] [security2:error] [pid 28182:tid 28182] [client 194.104.11.201:13353] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|cookerwars.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cookerwars.com"] [uri "/"] [unique_id "abyuTooKRWSYujglYHIVOQAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-07 00:51:19 (5 months ago)	(mod_security) mod_security (id:210350) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 194.104.11.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 06 19:51:11.063449 2026] [security2:error] [pid 14918:tid 14918] [client 194.104.11.201:62759] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|rcjlawfirm.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rcjlawfirm.com"] [uri "/texas-and-taxes-law-blog/corporate-transparency-update-part-ii"] [unique_id "aat2fyxDJreOGONn33kXZQAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 voormedia	2026-02-27 06:00:50 (5 months ago)	Accessed trap at '/xmlrpc.php'	Web App Attack
🇺🇸 dtorrer	2026-02-06 08:52:27 (6 months ago)	Client attempted to submit spam on a website post.	Blog Spam

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 217.113.196.230

🇸🇦 128.234.158.112

🇺🇸 45.194.67.45

🇺🇸 34.138.227.163

🇳🇱 5.83.143.166

🇬🇧 193.163.125.40

🇸🇪 192.178.93.150

🇫🇷 167.86.117.236

🇨🇦 142.165.152.6

🇺🇸 104.23.160.172

🇧🇬 79.124.62.230

🇧🇷 45.205.1.240

🇮🇳 2405:201:e034:7863:f47e:ae6b:41c8:def4

🇨🇬 197.214.238.43

🇲🇦 196.64.209.27

🇬🇧 188.240.59.53

🇨🇳 180.114.233.178

🇳🇱 178.62.249.44

🇻🇳 171.231.190.48

🇬🇧 154.16.44.135