JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.5.48.138

194.5.48.138 was found in our database!

This IP was reported 103 times. Confidence of Abuse is 79%: ?

79%

ISP	VPN Consumer Tokyo, Japan
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.5.48.138

Whois 194.5.48.138

IP Abuse Reports for 194.5.48.138:

This IP address has been reported a total of 103 times from 64 distinct sources. 194.5.48.138 was first reported on November 29th 2024, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ambor	2026-07-09 23:09:44 (20 hours ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 WeekendWeb	2026-07-08 19:14:35 (2 days ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 18:49:28 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 14:49:24.503302 2026] [security2:error] [pid 12070:tid 12081] [client 194.5.48.138:27501] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.138 (+1 hits since last alert)\|conservativelabor.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "conservativelabor.com"] [uri "/xmlrpc.php"] [unique_id "ak6btMNa1KRaSDFiznCuuAAAAEg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-07-07 17:42:04 (3 days ago)	Wordfence waf block on parsol	Web App Attack
🇯🇵 Short-legs-Spider	2026-07-04 13:52:52 (6 days ago)	Test on existence -- [04/Jul/2026:22:52:52 +0900] "GET /wp-login.php HTTP/1.1" 403 76 "-" "Mozilla ... show more Test on existence -- [04/Jul/2026:22:52:52 +0900] "GET /wp-login.php HTTP/1.1" 403 76 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0" show less	Web App Attack
🇳🇿 Antinson	2026-07-04 01:06:49 (6 days ago)	Scraping with a high error ratio and request rate	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-30 10:42:13 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 06:42:09.931872 2026] [security2:error] [pid 21654:tid 21654] [client 194.5.48.138:35045] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.138 (+1 hits since last alert)\|arsenalfordemocracy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "arsenalfordemocracy.com"] [uri "/xmlrpc.php"] [unique_id "akOdgdtdEcuMcTpLfbqg-gAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-06-30 09:49:41 (1 week ago)	Aggressive web search of vulnerable pages: /.well-known/acme-challenge/install.php /.well-known/acme ... show more Aggressive web search of vulnerable pages: /.well-known/acme-challenge/install.php /.well-known/acme-challenge/plugins.php /.well-known/acme-ch ... show less	Web App Attack
🇫🇷 masterguru	2026-06-30 08:10:33 (1 week ago)	Too much 404 requests in 1 minute. Operator GE matched 10 at IP:block_script. (46020-197)	Hacking
🇺🇸 ambor	2026-06-30 00:25:14 (1 week ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇳🇱 ConsulHosting	2026-06-29 17:12:04 (1 week ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇳🇱 Site.eu	2026-06-28 20:37:03 (1 week ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 ambor	2026-06-25 17:57:18 (2 weeks ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 11:58:24 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 07:58:19.665946 2026] [security2:error] [pid 22672:tid 22686] [client 194.5.48.138:23867] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.138 (+1 hits since last alert)\|mail.sallykimmel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "mail.sallykimmel.com"] [uri "/xmlrpc.php"] [unique_id "aj0X21X8RE2ZwTURgTmBJQAAAEk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 dtorrer	2026-06-25 10:30:24 (2 weeks ago)	Brute-force general attack.	Brute-Force

Showing 1 to 15 of 103 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a09:bac5:3801:294b::41d:3b

🇨🇳 124.226.216.189

🇨🇳 101.96.227.188

🇯🇵 43.163.195.170

🇰🇷 220.118.173.234

🇮🇪 207.254.71.129

🇵🇱 176.53.159.198

🇨🇳 49.64.169.153

🇹🇷 31.206.150.184

🇧🇴 186.121.201.131

🇨🇳 175.30.48.151

🇺🇸 162.216.149.148

🇻🇳 160.191.89.47

🇳🇱 88.151.33.188

🇺🇸 47.251.120.157

🇨🇦 24.122.136.94

🇷🇴 5.14.163.51

🇵🇪 161.132.47.68

🇪🇬 82.201.143.184

🇳🇱 78.142.18.172