JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.32.120.149

194.32.120.149 was found in our database!

This IP was reported 75 times. Confidence of Abuse is 17%: ?

17%

ISP	VPN Consumer London, United Kingdom
Usage Type	Data Center/Web Hosting/Transit
ASN	AS42831
Domain Name	vpnconsumer.com
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.32.120.149

Whois 194.32.120.149

IP Abuse Reports for 194.32.120.149:

This IP address has been reported a total of 75 times from 43 distinct sources. 194.32.120.149 was first reported on September 19th 2022, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-06-10 22:28:22 (1 week ago)		Brute-Force Web App Attack
🇫🇷 SpaceHost-Server	2026-06-09 22:27:41 (1 week ago)		Brute-Force Web App Attack
🇯🇵 demonsword	2026-06-05 09:58:46 (1 week ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: api.cyberghostvpn.com:443 show less	Open Proxy Port Scan
🇳🇱 melroy89	2026-05-03 00:52:10 (1 month ago)	194.32.120.149 - - [03/May/2026:02:51:39 +0200] "GET /m/[email protected]/combined/hot/1 ... show more 194.32.120.149 - - [03/May/2026:02:51:39 +0200] "GET /m/[email protected]/combined/hot/1m HTTP/1.1" 302 282 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36" "kbin.melroy.org" 0.018 ... show less	DDoS Attack
🇺🇸 fortypoundhead	2026-04-10 06:52:34 (2 months ago)	Banned IP Address	Hacking Web App Attack
🇫🇷 dynamix	2026-03-17 20:42:25 (3 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-02-25 00:09:30 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 194.32.120.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 194.32.120.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 19:09:27.837152 2026] [security2:error] [pid 28136:tid 28136] [client 194.32.120.149:48217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bitcoinsquaretrader.com"] [uri "/backups/sftp-config.json"] [unique_id "aZ49t3ORbOSLmHNXolJOhQAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-24 23:29:14 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 194.32.120.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 194.32.120.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 18:29:07.785579 2026] [security2:error] [pid 3166:tid 3166] [client 194.32.120.149:30173] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.spectorworld.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.spectorworld.com"] [uri "/restore/wallet.dat"] [unique_id "aZ40Q6YamgvL7lXCqcAc7AAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-02-18 02:56:00 (4 months ago)	IPBlock protected site ID [4055-d][s=01]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇩🇪 ps-center	2026-02-18 00:05:42 (4 months ago)	C1: Web Attack GET /wp-content/ GET /wp-includes/widgets/ GET /wp-admin/network/ GET /wp-admin/css/c ... show more C1: Web Attack GET /wp-content/ GET /wp-includes/widgets/ GET /wp-admin/network/ GET /wp-admin/css/colors/sunrise/ GET /wp-includes/theme-compat/ show less	Web Spam Hacking Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-02-13 18:20:19 (4 months ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-02-13 10:20:35 (4 months ago)	194.32.120.149 - - [13/Feb/2026:12:20:33 +0200] "GET //wp-admin/maint/about.php HTTP/1.1" 404 271 "- ... show more 194.32.120.149 - - [13/Feb/2026:12:20:33 +0200] "GET //wp-admin/maint/about.php HTTP/1.1" 404 271 "-" "Go-http-client/1.1" 194.32.120.149 - - [13/Feb/2026:12:20:34 +0200] "GET //wp-content/plugins/hello-plus/classes/ehp-social-elf.php HTTP/1.1" 404 271 "-" "Go-http-client/1.1" ... show less	Web App Attack
🇧🇪 cmbplf	2026-01-29 03:24:17 (4 months ago)	236 requests with url.path /.well-known/pki-validation/.php	Brute-Force Bad Web Bot
🇫🇷 dynamix	2026-01-27 16:54:47 (4 months ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-01-27 15:49:11 (4 months ago)	Web App Attack	Brute-Force Web App Attack

Showing 1 to 15 of 75 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇴 190.181.27.37

🇺🇸 185.255.9.49

🇮🇳 175.101.131.169

🇨🇳 117.57.117.153

🇺🇸 107.155.105.122

🇺🇸 104.252.191.30

🇺🇸 63.141.48.159

🇳🇱 45.148.10.157

🇦🇺 45.132.225.92

🇮🇳 210.212.136.3

🇳🇱 176.65.139.183

🇨🇳 106.12.241.195

🇻🇳 103.200.25.79

🇺🇸 103.196.9.66

🇬🇧 35.203.211.100

🇭🇰 199.45.154.114

🇨🇳 121.40.84.38

🇻🇳 113.173.217.0

🇷🇺 95.37.147.5

🇳🇱 91.92.40.171