JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

194.99.25.20

Recent Activity

Abuse Confidence Score

22% Elevated

60 reports

27 reporters · latest 32 minutes ago

ISP: FINE GROUP SERVERS SOLUTIONS LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS26548
Domain Name: finegroupservers.com
Country: 🇺🇸 United States of America
City: Seattle, Washington

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

60 from 27 distinct reporters

First reported

December 11th 2020

Most recent report

32 minutes ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇦🇺 Australia 1 🇩🇪 Germany 1

Most common categories Bad Web Bot 4 Web App Attack 4 Brute-Force 3 Hacking 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-11-15 10:53:51 UTC · (32 minutes ago)	(mod_security) mod_security (id:210350) triggered by 194.99.25.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 05:53:48.348467 2026] [security2:error] [pid 26552:tid 26656] [client 194.99.25.20:58045] Mod ... show more (mod_security) mod_security (id:210350) triggered by 194.99.25.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 05:53:48.348467 2026] [security2:error] [pid 26552:tid 26656] [client 194.99.25.20:58045] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|howardhallis.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "howardhallis.com"] [uri "/doctorstrange/posters/postersB/files/res/sounds"] [unique_id "avmPPJ-_cbxN5_ZrGiPCZgAAApA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-11-15 06:24:27 UTC · (5 hours ago)	Not following 301 redirects — wasted requests \| method: GET \| path: /produit/totems/totem-ellipse/ \| ua: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0	Bad Web Bot
🇺🇸 TPI-Abuse	2026-11-10 13:20:35 UTC · (4 days ago)	(mod_security) mod_security (id:210350) triggered by 194.99.25.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:20:28.015790 2026] [security2:error] [pid 15555:tid 15555] [client 194.99.25.20:45771] Mod ... show more (mod_security) mod_security (id:210350) triggered by 194.99.25.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:20:28.015790 2026] [security2:error] [pid 15555:tid 15555] [client 194.99.25.20:45771] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.jerusalem-korczak-home.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/new/levi/levi109.html"] [unique_id "avMaHIF-qBA5k-8GmV9dyAAAAC4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-07 09:54:24 UTC · (1 week ago)	(mod_security) mod_security (id:210350) triggered by 194.99.25.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 04:54:19.918923 2026] [security2:error] [pid 29960:tid 29960] [client 194.99.25.20:40139] Mod ... show more (mod_security) mod_security (id:210350) triggered by 194.99.25.20 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 04:54:19.918923 2026] [security2:error] [pid 29960:tid 29960] [client 194.99.25.20:40139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.alexgitlin.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.alexgitlin.com"] [uri "/npp/argent.htm"] [unique_id "au71S-xRG_5q3PvQqrpSlQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-15 14:16:01 UTC · (4 weeks ago)	Malicious activity detected	Hacking Web App Attack
Anonymous	2026-08-31 12:13:48 UTC · (2 months ago)	Global Protect brute force attempt	Brute-Force Web App Attack
🇺🇸 ThreatsIntelz	2026-08-27 22:15:54 UTC · (2 months ago)	SSL-VPN brute-force / password-guessing attempts against FortiGate SSLVPN. Observed source subnet 194.99.25.0/24 (owner: FINEGROUPSERVERS-LEASE); 2 attempts above threshold.	Brute-Force SSH
Anonymous	2026-08-20 19:37:47 UTC · (2 months ago)	VPN portal credential brute-force / password spray against a SAML-only GlobalProtect portal (10 attempt(s) observed, 10 username(s) tried). Source blocked on our perimeter.	Brute-Force
Anonymous	2026-08-20 09:47:50 UTC · (2 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇳🇱 donarev419	2026-05-26 12:42:28 UTC · (5 months ago)	2026-05-26T14:42:27.345148+02:00 donarev419.com sshd[405368]: Invalid user admin from 194.99.25.20 port 59441 ...	Brute-Force SSH
Anonymous	2026-04-10 09:28:49 UTC · (7 months ago)	ModSecurity rejected a query	Bad Web Bot Web App Attack
Anonymous	2026-04-04 14:25:05 UTC · (7 months ago)	"POST /xmlrpc.php HTTP/1.1"	Hacking Web App Attack
🇺🇸 ANTI SCANNER	2026-02-20 23:39:50 UTC · (8 months ago)	Scanner : /xmlrpc.php	Web Spam
🇩🇪 london2038.com	2026-02-20 04:09:36 UTC · (8 months ago)	Detected by WP fail2ban 2026-02-20T05:09:35.378915+01:00 wordpress: Authentication attempt from 194.99.25.20	Brute-Force Web App Attack
Anonymous	2026-02-18 10:21:54 UTC · (8 months ago)	"POST /xmlrpc.php HTTP/1.1"	Hacking Web App Attack

Showing 1 to 15 of 60 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇷 190.196.253.30

🇩🇪 185.220.101.59

🇸🇬 34.87.60.140

🇧🇪 34.14.75.75

🇬🇧 2.57.17.213

🇨🇳 220.167.233.83

🇨🇳 180.102.110.171

🇺🇸 173.239.84.66

🇺🇦 83.142.111.170

🇷🇺 82.162.62.182

🇺🇸 74.82.47.2

🇺🇸 68.183.116.145

🇧🇪 35.210.126.209

🇬🇧 35.203.211.84

🇺🇦 188.163.0.178

🇲🇦 160.179.81.34

🇺🇸 159.203.185.8

🇩🇪 107.150.117.219

🇳🇱 77.67.26.34

🇺🇸 73.41.139.22