JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.5.48.140

194.5.48.140 was found in our database!

This IP was reported 89 times. Confidence of Abuse is 57%: ?

57%

ISP	VPN Consumer Tokyo, Japan
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.5.48.140

Whois 194.5.48.140

IP Abuse Reports for 194.5.48.140:

This IP address has been reported a total of 89 times from 44 distinct sources. 194.5.48.140 was first reported on December 31st 2024, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 neckaralb-admin.de	2026-07-15 16:33:22 (11 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 ambor	2026-07-14 07:05:46 (1 day ago)	Honeypot triggered: /xmlrpc.php on ifebridge.com. User-Agent: Mozilla/5.0 (Linux; Android 13; SM-G99 ... show more Honeypot triggered: /xmlrpc.php on ifebridge.com. User-Agent: Mozilla/5.0 (Linux; Android 13; SM-G998B) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36. Method: POST show less	Web App Attack
🇺🇸 ambor	2026-07-14 05:42:16 (1 day ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇩🇪 neckaralb-admin.de	2026-07-13 17:21:50 (2 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 00:39:23 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 20:39:20.601174 2026] [security2:error] [pid 9262:tid 9262] [client 194.5.48.140:49089] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.140 (+1 hits since last alert)\|dailybeautysupply.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "dailybeautysupply.com"] [uri "/xmlrpc.php"] [unique_id "alGQuPLJZeomyZHjn7aAgAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 00:04:39 (5 days ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 20:04:35.672947 2026] [security2:error] [pid 19203:tid 19330] [client 194.5.48.140:26147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.140 (+1 hits since last alert)\|nordicatrio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "nordicatrio.com"] [uri "/xmlrpc.php"] [unique_id "alGIk7x0t-o3EZevS0hRNQAAAYU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-10 22:07:18 (5 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 ambor	2026-07-10 12:09:19 (5 days ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 18:30:39 (6 days ago)	(mod_security) mod_security (id:240335) triggered by 194.5.48.140 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 194.5.48.140 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 14:30:32.426638 2026] [security2:error] [pid 13793:tid 13793] [client 194.5.48.140:55357] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 194.5.48.140 (+1 hits since last alert)\|michelehoop.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "michelehoop.com"] [uri "/xmlrpc.php"] [unique_id "ak_oyNz-_-x-d9JjOcK-3QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-07-08 01:32:23 (1 week ago)	[WedJul0803:32:16.4328772026][security2:error][pid2190812:tid2191141][client194.5.48.140:0]ModSecuri ... show more [WedJul0803:32:16.4328772026][security2:error][pid2190812:tid2191141][client194.5.48.140:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"benvenutialfood.org\"][uri\"/xmlrpc.php\"][unique_id\"ak2ooKWltPIz_r0No-z8wAAAAVE\"] show less	Hacking Web App Attack
🇺🇸 WeekendWeb	2026-07-07 16:10:49 (1 week ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 ambor	2026-07-05 17:28:52 (1 week ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 ambor	2026-07-04 10:56:15 (1 week ago)	Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: ... show more Honeypot triggered on tcpdata.com - Attempted to access /xmlrpc.php (wordpress_xmlrpc). User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 show less	Web App Attack
🇨🇭 4server	2026-06-30 21:26:36 (2 weeks ago)	[TueJun3023:26:32.1041712026][security2:error][pid173060:tid173110][client194.5.48.140:0]ModSecurity ... show more [TueJun3023:26:32.1041712026][security2:error][pid173060:tid173110][client194.5.48.140:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"motogiro.com\"][uri\"/xmlrpc.php\"][unique_id\"akQ0iJtn_ohTQODdroNm8AAAAFE\"] show less	Hacking Web App Attack
🇺🇸 WeekendWeb	2026-06-30 09:04:41 (2 weeks ago)	Wordpress Vunerability attack	Web App Attack

Showing 1 to 15 of 89 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.47.82.173

🇭🇰 203.83.11.156

🇺🇸 195.184.76.92

🇵🇰 125.209.124.108

🇨🇦 20.220.9.199

🇺🇸 195.184.76.204

🇺🇸 195.184.76.11

🇧🇷 177.72.195.114

🇺🇸 170.106.101.97

🇺🇸 2a09:bac5:9443:3af::5e:53

🇫🇮 2a01:e5c0:3102::2

🇹🇭 202.183.141.133

🇹🇭 202.29.220.6

🇹🇼 198.235.24.109

🇨🇦 159.89.124.112

🇩🇪 151.243.150.222

🇱🇹 141.98.11.11

🇸🇬 114.119.151.9

🇳🇱 104.248.206.108

🇮🇳 103.181.56.73