JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

194.5.49.81

Recent Activity

Abuse confidence score ?

89% Critical

37 reports

25 reporters · latest 5 minutes ago

ISP	VPN Consumer Berlin, Germany
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇩🇪 Germany
City	Berlin, State of Berlin

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 194.5.49.81

Export CSV

This IP address has been reported a total of 37 times from 25 distinct sources. 194.5.49.81 was first reported on December 3rd 2023, and the most recent report was 5 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 7 reports; Germany with 5 reports; France with 2 reports. The most common categories in these recent reports were: Web App Attack 15 times; Brute-Force 7 times; Bad Web Bot 7 times; Port Scan 2 times; SSH 1 time; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 raph	2026-10-18 22:55:53 (5 minutes ago)	[DOT FILES] crawler .env, .git, .config, etc.	Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-10-18 22:17:21 (43 minutes ago)		Brute-Force Web App Attack
🇺🇸 dot.mg	2026-10-18 21:24:32 (1 hour ago)	Scan of vulnerable files	Web App Attack
🇩🇪 pltcldvlpr	2026-10-18 21:10:27 (1 hour ago)	CMS/framework probe: 194.5.49.81 - - [18/Oct/2026:23:10:26 +0200] "GET /wordpress/xmlrpc.php HTTP/2. ... show more CMS/framework probe: 194.5.49.81 - - [18/Oct/2026:23:10:26 +0200] "GET /wordpress/xmlrpc.php HTTP/2.0" 401 590 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" asn=212238 org="Datacamp Limited" country=DE ... show less	Web App Attack
🇩🇪 maxpower	2026-10-18 20:29:19 (2 hours ago)	(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 194.5.49.81 (DE/Germany/-): 3 in the last 3600 ... show more (nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 194.5.49.81 (DE/Germany/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2026/10/18 22:29:14 [error] 4185571#4185571: 4649778 access forbidden by rule, client: 194.5.49.81, server: studioegizi.it, request: "GET /blog/xmlrpc.php HTTP/2.0", host: "studioegizi.it" 2026/10/18 22:29:14 [error] 4185571#4185571: 4649778 access forbidden by rule, client: 194.5.49.81, server: studioegizi.it, request: "GET /wp/xmlrpc.php HTTP/2.0", host: "studioegizi.it" 2026/10/18 22:29:14 [error] 4185571#4185571: 4649778 access forbidden by rule, client: 194.5.49.81, server: studioegizi.it, request: "GET /wordpress/xmlrpc.php HTTP/2.0", host: "studioegizi.it" show less	Port Scan
🇺🇸 Gabriel Camargo	2026-10-18 20:17:45 (2 hours ago)	194.5.49.81 - - [18/Oct/2026:15:17:45 -0500] "GET /wordpress/xmlrpc.php HTTP/1.1" 301 178 "-" "Mozil ... show more 194.5.49.81 - - [18/Oct/2026:15:17:45 -0500] "GET /wordpress/xmlrpc.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 194.5.49.81 - - [18/Oct/2026:15:17:45 -0500] "GET /blog/xmlrpc.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 194.5.49.81 - - [18/Oct/2026:15:17:45 -0500] "GET /xmlrpc.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" ... show less	Brute-Force SSH
🇬🇧 consul.to	2026-10-18 19:23:18 (3 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 Bedios GmbH	2026-10-18 19:20:45 (3 hours ago)	Scanning for WordPress Installations and Vulnerabilities	Web App Attack
Anonymous	2026-10-18 19:16:45 (3 hours ago)	(caddyscan) Scanner path probe from 194.5.49.81 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; D ... show more (caddyscan) Scanner path probe from 194.5.49.81 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 194.5.49.81 - - [18/Oct/2026:19:16:42 +0000] "GET /wp/xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 194.5.49.81 - - [18/Oct/2026:19:16:42 +0000] "GET /wordpress/xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 194.5.49.81 - - [18/Oct/2026:19:16:42 +0000] "GET /blog/xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 194.5.49.81 - - [18/Oct/2026:19:16:42 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 200 2627 194.5.49.81 - - [18/Oct/2026:19:16:44 +0000] "GET /xmlrpc.php HTTP/1.1" show less	Port Scan
🇦🇺 A.i.D.A.N.N	2026-10-18 19:15:58 (3 hours ago)	A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web vulnerability scanning detected	Web App Attack
🇵🇱 gandaflux	2026-10-18 19:01:55 (3 hours ago)	194.5.49.81 [redacted-domain] - [18/Oct/2026:21:01:50 +0200] "GET /xmlrpc.php HTTP/2.0" 403 158 "-" ... show more 194.5.49.81 [redacted-domain] - [18/Oct/2026:21:01:50 +0200] "GET /xmlrpc.php HTTP/2.0" 403 158 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 194.5.49.81 [redacted-domain] - [18/Oct/2026:21:01:50 +0200] "GET /wordpress/xmlrpc.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 194.5.49.81 [redacted-domain] - [18/Oct/2026:21:01:50 +0200] "GET /blog/xmlrpc.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 194.5.49.81 [redacted-domain] - [18/Oct/2026:21:01:50 +0200] "GET /wp/xmlrpc.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 194.5.49.81 [redacted-domain] - [18/Oc show less	Brute-Force Web App Attack
Anonymous	2026-10-18 18:21:36 (4 hours ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇫🇷 masterguru	2026-10-18 03:56:11 (19 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 194.5.49.81 (DE/Germany/-): 2 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 194.5.49.81 (DE/Germany/-): 2 in the last 3600 secs (0-196) show less	Hacking
🇫🇮 as211431.net	2026-10-18 03:41:23 (19 hours ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇭 backslash	2026-10-14 16:36:01 (4 days ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 177.85.127.187

🇮🇳 152.58.157.71

🇨🇳 120.34.139.94

🇪🇸 113.30.149.218

🇧🇪 104.199.36.53

🇷🇺 89.109.51.185

🇫🇷 85.217.140.15

🇫🇷 85.217.140.13

🇫🇷 85.217.140.12

🇫🇷 85.217.140.11

🇵🇷 72.50.2.77

🇺🇸 45.156.129.70

🇩🇪 45.115.26.85

🇬🇧 35.203.211.240

🇩🇪 34.32.26.228

🇳🇱 31.59.129.193

🇺🇸 18.227.107.145

🇨🇳 1.92.210.18

🇺🇸 199.195.248.205

🇺🇸 198.23.197.71