JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.99.24.120

194.99.24.120 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 19%: ?

19%

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46475
Domain Name	finegroupservers.com
Country	🇫🇮 Finland
City	Vantaa, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.99.24.120

Whois 194.99.24.120

IP Abuse Reports for 194.99.24.120:

This IP address has been reported a total of 26 times from 13 distinct sources. 194.99.24.120 was first reported on November 1st 2023, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 Nick Lewis	2026-06-25 01:48:44 (2 days ago)	(mod_security) mod_security triggered on hostname [redacted] 194.99.24.120 (NL/The Netherlands/-)	SQL Injection
🇩🇪 london2038.com	2026-06-09 05:31:54 (2 weeks ago)	Detected by WP fail2ban 2026-06-09T07:31:53.676929+02:00 wordpress: Authentication attempt from 194. ... show more Detected by WP fail2ban 2026-06-09T07:31:53.676929+02:00 wordpress: Authentication attempt from 194.99.24.120 show less	Brute-Force Web App Attack
Anonymous	2026-05-27 07:50:06 (1 month ago)	SQL injection, multiple attempts.	SQL Injection
🇺🇸 TPI-Abuse	2026-05-16 00:27:25 (1 month ago)	(mod_security) mod_security (id:211030) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211030) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 20:27:19.931307 2026] [security2:error] [pid 6780:tid 6780] [client 194.99.24.120:32479] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at ARGS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "17"] [id "211030"] [rev "3"] [msg "COMODO WAF: LDAP Injection Attack\|\|www.genesis-castle.com\|F\|2"] [data "Matched Data: ('~'\|\|( found within ARGS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "www.genesis-castle.com"] [uri "/gallery/index.php"] [unique_id "age55_ydoAPp2PbImUzIhQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-30 09:20:16 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 05:20:09.898760 2026] [security2:error] [pid 2594:tid 2594] [client 194.99.24.120:29553] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|donnysimonton.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "donnysimonton.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acpASUGGkXHW5eB0KbgiugAAAAs"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-14 23:15:30 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 19:15:27.162443 2026] [security2:error] [pid 17452:tid 17452] [client 194.99.24.120:53721] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|rohn.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rohn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abXsD2TdFpMA2IhKBxZLvgAAAAk"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-03-01 08:56:16 (3 months ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇨🇦 SSH-Admin	2026-02-07 17:12:28 (4 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-01-30 06:15:25 (4 months ago)	(mod_security) mod_security (id:210350) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 194.99.24.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 30 01:15:18.099912 2026] [security2:error] [pid 26175:tid 26175] [client 194.99.24.120:33023] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|daebakdesign.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "daebakdesign.com"] [uri "/wp-login.php"] [unique_id "aXxMdgj59YIat9c5fTWzjgAAABU"], referer: http://daebakdesign.com show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 Shaik Sai Meera	2026-01-26 12:40:13 (5 months ago)	IM360 WAF: Infectors: Suspicious access attempt (webshell)	FTP Brute-Force Open Proxy Brute-Force
🇫🇷 masterguru	2026-01-24 16:40:55 (5 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-22 10:42:29 (5 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-19 17:46:11 (5 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-14 03:19:31 (5 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-07 04:22:29 (5 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 194.99.24.120 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇴 149.2.82.101

🇺🇸 2a00:1450:4864:20::348

🇺🇸 216.25.89.136

🇯🇵 164.52.24.182

🇧🇷 161.22.59.178

🇬🇧 157.245.38.26

🇧🇷 138.255.230.4

🇬🇧 94.0.23.48

🇫🇷 51.159.149.103

🇭🇰 223.18.211.242

🇪🇸 212.227.154.251

🇧🇷 190.9.83.33

🇲🇽 187.216.224.85

🇨🇷 177.93.3.79

🇺🇸 172.172.119.98

🇸🇬 103.13.206.100

🇳🇴 89.10.243.122

🇱🇻 81.30.98.144

🇵🇱 45.159.21.82

🇳🇱 45.148.10.147