JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.5.48.109

194.5.48.109 was found in our database!

This IP was reported 107 times. Confidence of Abuse is 90%: ?

90%

ISP	VPN Consumer Tokyo, Japan
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.5.48.109

Whois 194.5.48.109

IP Abuse Reports for 194.5.48.109:

This IP address has been reported a total of 107 times from 65 distinct sources. 194.5.48.109 was first reported on November 29th 2024, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Octopuce	2026-06-30 09:48:51 (15 hours ago)	Aggressive web search of vulnerable pages: /buy.php /wp-content/languages/wp-conflg.php /wp-content/ ... show more Aggressive web search of vulnerable pages: /buy.php /wp-content/languages/wp-conflg.php /wp-content/themes/classwithtostring.php /wp-content/pl ... show less	Web App Attack
🇳🇱 Mangelot Hosting	2026-06-30 07:35:22 (17 hours ago)	(upload_shell) srv104 Shell upload 194.5.48.109 (JP/Japan/-): 1 in the last 3600 secs; Ports: ; Dir ... show more (upload_shell) srv104 Shell upload 194.5.48.109 (JP/Japan/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇳🇱 Site.eu	2026-06-30 02:06:39 (23 hours ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 ConsulHosting	2026-06-29 17:10:24 (1 day ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇫🇷 masterguru	2026-06-29 06:46:34 (1 day ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-201)	Hacking
🇫🇮 decode5921	2026-06-26 22:30:02 (4 days ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇫🇮 decode5921	2026-06-25 22:15:02 (5 days ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇺🇸 dtorrer	2026-06-25 21:27:12 (5 days ago)	Brute-force general attack.	Brute-Force
🇺🇸 TPI-Abuse	2026-06-25 11:51:38 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.109 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 07:51:32.375891 2026] [security2:error] [pid 9512:tid 9523] [client 194.5.48.109:32789] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.109 (+1 hits since last alert)\|mail.coasterdvdsonline.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mail.coasterdvdsonline.com"] [uri "/xmlrpc.php"] [unique_id "aj0WRDozYBOZGSu2InySxgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ambor	2026-06-25 08:34:25 (5 days ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 ambor	2026-06-25 01:37:43 (5 days ago)	Honeypot triggered: /xmlrpc.php on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x ... show more Honeypot triggered: /xmlrpc.php on ifebridge.com. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36. Method: POST show less	Web App Attack
🇨🇭 4server	2026-06-25 00:26:11 (6 days ago)	[ThuJun2502:26:06.9836412026][security2:error][pid1046304:tid1046306][client194.5.48.109:0]ModSecuri ... show more [ThuJun2502:26:06.9836412026][security2:error][pid1046304:tid1046306][client194.5.48.109:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"comarcosa.com\"][uri\"/xmlrpc.php\"][unique_id\"ajx1nkS9F0U_9P8UjMs8FAAAAAA\"] show less	Hacking Web App Attack
🇫🇮 decode5921	2026-06-24 22:00:03 (6 days ago)	Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that softwa ... show more Honeypot hit (honeypot:wp) — probed a non-existent bait path on a site that does not run that software. show less	Brute-Force Web App Attack
🇬🇧 consul.to	2026-06-24 00:26:21 (1 week ago)	Web attack/malicious scanning detected	Web App Attack
🇨🇭 backslash	2026-06-23 23:03:00 (1 week ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot

Showing 1 to 15 of 107 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 186.96.158.180

🇨🇴 181.174.228.115

🇫🇮 147.185.133.187

🇨🇳 113.141.72.65

🇱🇹 62.60.130.219

🇧🇷 189.89.247.229

🇮🇳 182.19.35.57

🇭🇰 165.154.42.209

🇺🇸 162.240.35.200

🇺🇸 162.216.149.139

🇧🇩 103.234.202.37

🇬🇧 87.236.176.16

🇿🇦 41.135.36.226

🇳🇱 213.21.248.107

🇧🇩 202.191.127.246

🇲🇴 182.93.7.194

🇺🇸 68.160.129.207

🇮🇳 61.1.173.194

🇧🇷 45.205.1.246

🇷🇺 45.142.34.201