JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

194.26.192.112

Neutral Activity

Abuse confidence score ?

0% Low Risk

489 reports

180 reporters · latest 9 months ago

ISP	1337 Services GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS210558
Hostname(s)	194.26.192.112.powered.by.rdp.sh
Domain Name	as210558.net
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

194.26.192.112 has been reported 489 times. The most recent report is from 9 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 194.26.192.112

Export CSV

This IP address has been reported a total of 489 times from 180 distinct sources. 194.26.192.112 was first reported on January 4th 2023, and the most recent report was 9 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-01-11 19:48:10 (9 months ago)	$f2bV_matches	Brute-Force
🇺🇸 octageeks.com	2026-01-06 05:06:23 (9 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇫🇷 SpaceHost-Server	2026-01-05 23:38:45 (9 months ago)		Brute-Force Web App Attack
Anonymous	2026-01-05 17:18:55 (9 months ago)	Multiple, malicious web requests detected	Port Scan Hacking
🇫🇷 pm33	2026-01-05 11:37:36 (9 months ago)	Unauthorized connections HTTP 403	Web App Attack
🇳🇱 Site.eu	2026-01-05 11:30:30 (9 months ago)	Excessive multi-domain requests	Brute-Force
🇮🇹 mgarofano80	2026-01-05 10:37:48 (9 months ago)		Brute-Force Web App Attack
🇧🇪 cmbplf	2026-01-05 08:24:16 (9 months ago)	609 requests with url.path .alfa 325 requests with url.path /wp-plain.php	Brute-Force Bad Web Bot
🇬🇧 Swiptly	2026-01-05 07:37:01 (9 months ago)	Excessive 403/404/405 PHP/CMS errors from scanning or broken bots ...	Web App Attack
🇪🇸 el-brujo	2026-01-05 07:07:15 (9 months ago)	05/Jan/2026:08:07:14.316518 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 05/Jan/2026:08:07:14.316518 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 194.26.192.112] ModSecurity: Warning. Pattern match "(?:^\|=)\\\\\\\\s(?:{\|\\\\\\\\s\\\\\\\$\\\\\\\\s\|\\\\\\\\w+=(?:[^\\\\\\\\s]\|\\\\\\\\$.\|\\\\\\\\$.\|<.\|>.\|\\\\\\\\'.\\\\\\\\'\|\\\\".\\\\")\\\\\\\\s+\|!\\\\\\\\s\|\\\\\\\\$)\\\\\\\\s(?:'\|\\\\")(?:[\\\\\\\\?\\\\\\\\\\\\\\\\[\\\\\\\\]\\\\\\\\(\\\\\\\$\\\\\\\\-\\\\\\\\\|+\\\\\\\\w'\\\\"\\\\\\\\./\\\\\\\\\\\\\\\\]+/)?[\\\\\\\\\\\\\\\\'\\\\"](?:l[\\\\\\\\\\\\\\\\'\\\\"](?:s(?:[\\\\\\\\\\\\\\\\'\\\\"](?:b[\\\\\\\\\\\\\\\\'\\\\"]_[\\\\\\\\\\\\\\\\'\\\\"]r[\\\\\\\\\\\\\\\\'\\\\"]e[\\\\\\\\\\\\\\\\'\\\\"]l[\\\\\\\\\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver ... show less	Hacking Web App Attack
🇲🇾 Rizzy	2026-01-05 06:25:54 (9 months ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 antlac1	2026-01-05 06:07:03 (9 months ago)	crowdsecurity/http-wordpress-scan	Brute-Force Web App Attack
🇪🇸 el-brujo	2026-01-05 05:28:27 (9 months ago)	05/Jan/2026:06:28:26.655714 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 05/Jan/2026:06:28:26.655714 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 194.26.192.112] ModSecurity: Warning. Pattern match "(?:^\|=)\\\\\\\\s(?:{\|\\\\\\\\s\\\\\\\$\\\\\\\\s\|\\\\\\\\w+=(?:[^\\\\\\\\s]\|\\\\\\\\$.\|\\\\\\\\$.\|<.\|>.\|\\\\\\\\'.\\\\\\\\'\|\\\\".\\\\")\\\\\\\\s+\|!\\\\\\\\s\|\\\\\\\\$)\\\\\\\\s(?:'\|\\\\")(?:[\\\\\\\\?\\\\\\\\\\\\\\\\[\\\\\\\\]\\\\\\\\(\\\\\\\$\\\\\\\\-\\\\\\\\\|+\\\\\\\\w'\\\\"\\\\\\\\./\\\\\\\\\\\\\\\\]+/)?[\\\\\\\\\\\\\\\\'\\\\"](?:l[\\\\\\\\\\\\\\\\'\\\\"](?:s(?:[\\\\\\\\\\\\\\\\'\\\\"](?:b[\\\\\\\\\\\\\\\\'\\\\"]_[\\\\\\\\\\\\\\\\'\\\\"]r[\\\\\\\\\\\\\\\\'\\\\"]e[\\\\\\\\\\\\\\\\'\\\\"]l[\\\\\\\\\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver ... show less	Hacking Web App Attack
🇺🇸 antlac1	2026-01-05 04:52:53 (9 months ago)	crowdsecurity/http-bad-user-agent	Brute-Force Web App Attack
🇳🇱 Mangelot Hosting	2026-01-05 03:44:04 (9 months ago)	(modsecurity) srv201 ModSecurity 194.26.192.112 (NL/The Netherlands/194.26.192.112.powered.by.rdp.sh ... show more (modsecurity) srv201 ModSecurity 194.26.192.112 (NL/The Netherlands/194.26.192.112.powered.by.rdp.sh): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack

Showing 1 to 15 of 489 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 180.149.219.135

🇺🇸 104.168.105.27

🇺🇸 45.131.194.103

🇳🇱 193.47.62.69

🇰🇷 175.209.156.146

🇺🇸 167.172.140.103

🇨🇳 116.18.160.128

🇬🇧 89.37.172.139

🇺🇸 50.114.236.89

🇬🇪 46.49.11.90

🇳🇱 45.148.10.151

🇦🇷 190.105.160.5

🇨🇴 186.119.139.131

🇪🇸 185.230.52.249

🇲🇾 180.72.81.77

🇩🇿 154.242.156.86

🇧🇷 147.15.13.233

🇮🇳 121.242.232.216

🇨🇳 120.36.16.244

🇨🇳 101.71.221.73