JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.99.25.35

194.99.25.35 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 0%: ?

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS26548
Domain Name	finegroupservers.com
Country	🇺🇸 United States of America
City	Seattle, Washington

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.99.25.35

Whois 194.99.25.35

IP Abuse Reports for 194.99.25.35:

This IP address has been reported a total of 15 times from 11 distinct sources. 194.99.25.35 was first reported on June 30th 2023, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 relianoid.com	2026-05-07 22:21:01 (1 month ago)	POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com	Web Spam
🇺🇸 TPI-Abuse	2026-03-26 01:08:30 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 194.99.25.35 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 194.99.25.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 21:08:21.935739 2026] [security2:error] [pid 14231:tid 14231] [client 194.99.25.35:63427] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dmasoftlab.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dmasoftlab.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acSHBd3r8gxlqqlVM6l7UAAAAA4"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-31 22:49:07 (4 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.31 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.31 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 nodepile	2025-12-16 09:49:17 (5 months ago)	Requests denied due to proxy/VPN risk (tenant=82 method=GET path=/hid-projectors-parts-shrouds/hid-p ... show more Requests denied due to proxy/VPN risk (tenant=82 method=GET path=/hid-projectors-parts-shrouds/hid-projectors/luxen-bi-xenon-hella-evo-x-e55-projector.html ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.1995.17 Safari/537.36') show less	Open Proxy VPN IP
🇺🇸 nowyouknow	2025-07-18 03:10:26 (10 months ago)	(From [email protected]) We have hacked your website https://frostchiropractic.com and ex ... show more (From [email protected]) We have hacked your website https://frostchiropractic.com and extracted your databases. How did this happen? Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server. What does this mean? We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site https://frostchiropractic.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that you have indexed in the search engines will be de-indexed based off of blackhat techniques that we u show less	Phishing Web Spam
🇨🇭 backslash	2025-05-24 05:02:05 (1 year ago)		Bad Web Bot
🇺🇸 TPI-Abuse	2024-12-01 07:44:33 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 194.99.25.35 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 194.99.25.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 01 02:44:28.918863 2024] [security2:error] [pid 3682456:tid 3682456] [client 194.99.25.35:11933] [client 194.99.25.35] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|vitalitywebb.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Dandridge II/Thumbs.db"] [unique_id "Z0wT3J7ux5vRPrgwbsTMQgAAAAI"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Dandridge%20II/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 wil.com	2024-09-24 06:19:50 (1 year ago)	GlobalProtect login attempts with user ldenni.	VPN IP Brute-Force
🇮🇹 Progetto1	2024-07-15 05:16:01 (1 year ago)	Mail - Multiple failed login attempts	Brute-Force Exploited Host
🇺🇸 TPI-Abuse	2024-05-24 01:22:48 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 194.99.25.35 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 194.99.25.35 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 23 21:22:45.005055 2024] [security2:error] [pid 12984] [client 194.99.25.35:61683] [client 194.99.25.35] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|vitalitywebb.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Cooper/Thumbs.db"] [unique_id "Zk_r5bSPbj7bmGwK4Sf-pAAAABM"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Cooper/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-05-14 14:03:01 (2 years ago)	Malicious activity detected	Hacking Web App Attack
🇨🇭 backslash	2024-05-13 18:10:04 (2 years ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot
🇨🇭 backslash	2024-04-11 08:00:12 (2 years ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot
🇺🇸 VSM Networks	2024-02-18 21:30:53 (2 years ago)	Credential Stuffing	Brute-Force
Anonymous	2023-06-30 14:58:26 (2 years ago)	Backdrop CMS module - Blocked User-Agent: python-requests/2.28.2	Bad Web Bot Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 176.65.139.103

🇷🇺 146.158.121.28

🇲🇦 105.68.157.23

🇺🇸 45.147.235.102

🇬🇧 45.89.63.39

🇳🇱 195.178.110.31

🇳🇱 185.189.182.234

🇵🇾 181.126.74.117

🇺🇸 162.217.161.162

🇰🇿 145.255.168.79

🇷🇺 145.255.8.193

🇻🇳 113.166.174.195

🇻🇳 113.166.17.197

🇻🇳 113.165.82.161

🇺🇸 104.152.52.121

🇸🇦 144.86.40.18

🇵🇭 103.137.179.158

🇧🇬 91.191.209.98

🇺🇸 172.253.86.88

🇺🇸 167.99.110.148