JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.5.49.103

194.5.49.103 was found in our database!

This IP was reported 51 times. Confidence of Abuse is 100%: ?

100%

ISP	VPN Consumer Berlin, Germany
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.5.49.103

Whois 194.5.49.103

IP Abuse Reports for 194.5.49.103:

This IP address has been reported a total of 51 times from 35 distinct sources. 194.5.49.103 was first reported on April 21st 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-07-16 17:20:23 (7 hours ago)	CrowdSec: crowdsecurity/http-bad-user-agent \| req: / \| 2 distinct paths \| UA: Mozlila/5.0 (Linux; An ... show more CrowdSec: crowdsecurity/http-bad-user-agent \| req: / \| 2 distinct paths \| UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537. show less	Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-07-16 10:00:01 (14 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇫🇷 dynamix	2026-07-16 09:52:28 (14 hours ago)	Multiple WAF Violations	Web App Attack
🇳🇱 0xffffffff	2026-07-16 09:29:53 (15 hours ago)	[2026-07-16 12:29:51.526639] [authz_core:error] [pid 396145:tid 124364099167936] [client 194.5.49.10 ... show more [2026-07-16 12:29:51.526639] [authz_core:error] [pid 396145:tid 124364099167936] [client 194.5.49.103:0] AH01630: client denied by server configuration: /var/www//ALFA_DATA, referer www.google.com , error_notes:alfa-shell , URI:'/ALFA_DATA/alfacgiapi/perl.alfa' [2026-07-16 12:29:51.541669] [authz_core:error] [pid 396146:tid 124364225189568] [client 194.5.49.103:0] AH01630: client denied by server configuration: /var/www//wp-content/themes/seotheme, referer www.google.com , error_notes:wp:include-files , URI:'/wp-content/themes/seotheme/db.php?u' [2026-07-16 12:29:51.542864] [authz_core:error] [pid 396145:tid 124364082349760] [client 194.5.49.103:0] AH01630: client denied by server configuration: /var/www//wp-plain.php, referer www.google.com , error_notes:missing-php , URI:'/wp-plain.php' [2026-07-16 12:29:51.545030] [authz_core:error] [pid 396145:tid 124364082349760] [client 194.5.49.103:0] AH01630: client denied by server configuration: /var/www//wp-content/plugins/fix , error_notes:wp:include-files , U show less	Web App Attack Bad Web Bot
🇦🇺 paulshipley.com.au	2026-07-16 07:44:50 (16 hours ago)	[Thu Jul 16 17:44:48.667123 2026] [security2:error] [pid 482248] [client 194.5.49.103:63975] [client ... show more [Thu Jul 16 17:44:48.667123 2026] [security2:error] [pid 482248] [client 194.5.49.103:63975] [client 194.5.49.103] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/wp-plain.php"] [unique_id "aliL8E0Rcj6IeGeuWsiruQAAAAw"], referer: www.google.com ... show less	Web App Attack
🇩🇪 ramazan	2026-07-16 06:43:36 (17 hours ago)	Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /plugins/content/apismtp/apismtp.php?test=hello /sjygjzbd. ... show more Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /plugins/content/apismtp/apismtp.php?test=hello /sjygjzbd.php?Fox=d3wL7 /wp-content/plugins/apikey/apikey.php.suspected?test=hello /wp-content/plugins/apikey/apikey.php?test=hello /wp-content/plugins/fix/up.php show less	Web App Attack Hacking
🇷🇴 iulianh	2026-07-16 06:21:38 (18 hours ago)	80,443	Brute-Force SSH
🇮🇳 evicky2002	2026-07-16 06:00:00 (18 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
Anonymous	2026-07-16 01:56:03 (22 hours ago)	Automatically blocked after 11 security events. Observed web-shell or malicious-file probes. Source: ... show more Automatically blocked after 11 security events. Observed web-shell or malicious-file probes. Source: Cloudflare security controls. show less	Hacking Web App Attack
🇯🇵 S.O.B.A. Dev.	2026-07-16 01:49:12 (22 hours ago)	Web vulnerability scanning	Brute-Force Web Spam Web App Attack
🇩🇪 maxpower	2026-07-16 01:47:59 (22 hours ago)	(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 194.5.49.103 (DE/Germany/-): 1 in the last 3600 sec ... show more (backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 194.5.49.103 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 194.5.49.103 - - [16/Jul/2026:03:47:57 +0200] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 301 302 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "194.5.49.103" host=vortici.it show less	Port Scan
🇩🇪 Ba-Yu	2026-07-16 01:17:10 (23 hours ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇦🇺 clapper	2026-07-16 01:15:12 (23 hours ago)	(mod_security) mod_security (id:980001) triggered by 194.5.49.103 (DE/Germany/-): 5 in the last 600 ... show more (mod_security) mod_security (id:980001) triggered by 194.5.49.103 (DE/Germany/-): 5 in the last 600 secs; ID: rub show less	Brute-Force Bad Web Bot
🇫🇮 YF	2026-07-16 00:31:01 (1 day ago)	WordPress content enumeration	Web App Attack
🇦🇺 clapper	2026-07-15 23:20:12 (1 day ago)	(mod_security) mod_security (id:980001) triggered by 194.5.49.103 (DE/Germany/-): 5 in the last 3600 ... show more (mod_security) mod_security (id:980001) triggered by 194.5.49.103 (DE/Germany/-): 5 in the last 3600 secs; ID: Clar show less	Brute-Force Bad Web Bot

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 92.255.39.51

🇺🇸 2607:fb92:1886:67f3:8d6b:22bb:42fc:d53

🇲🇽 187.190.151.145

🇧🇷 187.51.208.158

🇹🇭 152.32.245.196

🇫🇷 146.70.194.228

🇵🇱 143.20.97.31

🇺🇦 134.249.13.28

🇫🇮 130.49.76.14

🇮🇳 123.253.162.254

🇻🇳 116.110.154.127

🇰🇷 112.217.188.122

🇫🇷 91.231.89.1

🇧🇬 79.124.56.246

🇧🇬 78.128.114.166

🇩🇪 69.5.169.80

🇩🇪 69.5.169.40

🇺🇸 64.23.236.208

🇺🇸 64.23.204.131

🇺🇸 64.23.193.81