JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.5.48.205

194.5.48.205 was found in our database!

This IP was reported 88 times. Confidence of Abuse is 38%: ?

38%

ISP	VPN Consumer Tokyo, Japan
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.5.48.205

Whois 194.5.48.205

IP Abuse Reports for 194.5.48.205:

This IP address has been reported a total of 88 times from 58 distinct sources. 194.5.48.205 was first reported on December 10th 2024, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 nyt	2026-06-22 01:04:49 (17 hours ago)	WP Author Enumeration	Web App Attack
🇺🇸 ambor	2026-06-19 22:14:44 (2 days ago)	Honeypot triggered: /wp-login.php on ifebridge.com. User-Agent: Mozilla/5.0. Method: GET	Web App Attack
Anonymous	2026-05-26 03:54:50 (3 weeks ago)	194.5.48.205 - - [26/May/2026:05:54:49 +0200] "GET /wp-content/plugins/SecurityFin/SecurityFin.php H ... show more 194.5.48.205 - - [26/May/2026:05:54:49 +0200] "GET /wp-content/plugins/SecurityFin/SecurityFin.php HTTP/1.1" 404 124 "-" "Go-http-client/1.1" 194.5.48.205 - - [26/May/2026:05:54:49 +0200] "GET /wp-content/themes/fukasawa/inc/classes/403.php HTTP/1.1" 404 124 "-" "Go-http-client/1.1" 194.5.48.205 - - [26/May/2026:05:54:49 +0200] "GET /wp-content/plugins/hello-plus/classes/ehp-social-elf.php HTTP/1.1" 404 124 "-" "Go-http-client/1.1" 194.5.48.205 - - [26/May/2026:05:54:50 +0200] "GET /wp-content/themes/theme-check/theme-check.php HTTP/1.1" 404 124 "-" "Go-http-client/1.1" 194.5.48.205 - - [26/May/2026:05:54:50 +0200] "GET /wp-content/plugins/WordPressCore/include.php HTTP/1.1" 404 124 "-" "Go-http-client/1.1" ... show less	Brute-Force Web App Attack
Anonymous	2026-05-26 03:15:05 (3 weeks ago)	Bot / scanning and/or hacking attempts: GET /content.php HTTP/1.1, GET /login.php HTTP/1.1, GET /adm ... show more Bot / scanning and/or hacking attempts: GET /content.php HTTP/1.1, GET /login.php HTTP/1.1, GET /admin.php HTTP/1.1, GET /themes.php HTTP/1.1, GET /gel4y.php HTTP/1.1, GET /xleet.php HTTP/1.1, GET /demo.php HTTP/1.1, GET /radio.php HTTP/1.1 show less	Hacking Web App Attack
🇨🇭 backslash	2026-05-26 02:21:01 (3 weeks ago)	block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638	Bad Web Bot
🇩🇪 webko.si	2026-05-26 00:09:04 (3 weeks ago)	pridenmozic.si: Bruteforce web app access, URI detail: '/wp-admin/ateprivacy-policy-guide.php'.	Web App Attack
🇩🇪 4server	2026-05-25 22:01:24 (3 weeks ago)	[TueMay2600:01:21.5016022026][security2:error][pid522195:tid522214][client194.5.48.205:0]ModSecurity ... show more [TueMay2600:01:21.5016022026][security2:error][pid522195:tid522214][client194.5.48.205:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"wp-content/uploads/.\*\\\\\\\\.ph$\?:p\\|tml\\|t$\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf\"][line\"5100\"][id\"382238\"][rev\"2\"][msg\"Atomicorp.comWAFRules-VirtualJustInTimePatch:PHPfileexecutioninuploadsdirectorydenied\"][data\"wp-content/uploads/elementor/index.php\"][severity\"CRITICAL\"][hostname\"feldenkraistherapy.ch\"][uri\"/wp-content/uploads/elementor/index.php\"][unique_id\"ahTGsdhme2rx1u5RV8DPoQAAAAQ\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 16:15:42 (4 weeks ago)	(mod_security) mod_security (id:234930) triggered by 194.5.48.205 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:234930) triggered by 194.5.48.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 12:15:35.115049 2026] [security2:error] [pid 27144:tid 27183] [client 194.5.48.205:37929] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)\|\|e-dome.ne.jp\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "e-dome.ne.jp"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "ahR1pxQS_pyCG3wo7g3FAwAAAMg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 afleventoffice.com.au	2026-05-25 05:32:54 (4 weeks ago)	GET /admin.php HTTP/1.1	Web App Attack
🇺🇸 TPI-Abuse	2026-04-15 10:32:48 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 194.5.48.205 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 194.5.48.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 15 06:32:44.033093 2026] [security2:error] [pid 2934594:tid 2934621] [client 194.5.48.205:61249] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|conservativedemocrat.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "conservativedemocrat.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad9pTD0qOM5w5ifcvyu90gAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇺 kranem	2026-03-23 09:00:41 (2 months ago)	Triggered Cloudflare WAF from JP. Action taken: BLOCK ASN: 206092 (SECFIREWALLAS) Protocol: HTTP/1.1 ... show more Triggered Cloudflare WAF from JP. Action taken: BLOCK ASN: 206092 (SECFIREWALLAS) Protocol: HTTP/1.1 (GET method) Endpoint: /cms/wp-includes/wlwmanifest.xml Timestamp: 2026-03-23T06:22:57Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 show less	Bad Web Bot
🇬🇧 consul.to	2026-02-21 01:44:01 (4 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 myagent.site	2026-02-04 03:21:32 (4 months ago)	Blocking for trying to access an exploit file: //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	Hacking
🇳🇱 maxxsense	2026-01-06 19:05:24 (5 months ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 194.5.48.205 (JP/Japan/- ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 194.5.48.205 (JP/Japan/-) show less	Port Scan
Anonymous	2026-01-06 17:10:01 (5 months ago)	suspicious request in access.log	Web App Attack

Showing 1 to 15 of 88 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇿🇦 197.184.83.155

🇺🇸 65.49.1.32

🇱🇹 45.227.254.170

🇺🇸 45.33.96.214

🇮🇳 122.185.187.2

🇺🇸 104.238.220.228

🇩🇪 104.28.164.239

🇳🇱 77.83.240.70

🇺🇸 67.217.245.142

🇨🇳 58.242.60.57

🇬🇧 37.10.113.222

🇮🇩 2620:171:74:f002:9999::243

🇺🇸 2607:f8b0:4023:1000::129

🇨🇳 180.167.207.234

🇧🇪 146.148.24.166

🇳🇱 91.92.40.202

🇮🇹 52.84.143.67

🇨🇦 15.156.110.125

🇧🇬 5.188.206.30

🇮🇹 2.57.170.219