JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 194.99.27.111

194.99.27.111 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 31%: ?

31%

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS43444
Domain Name	finegroupservers.com
Country	🇺🇸 United States of America
City	Newark, New Jersey

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 194.99.27.111

Whois 194.99.27.111

IP Abuse Reports for 194.99.27.111:

This IP address has been reported a total of 24 times from 12 distinct sources. 194.99.27.111 was first reported on September 26th 2024, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 london2038.com	2026-06-10 22:41:00 (1 hour ago)	Detected by WP fail2ban 2026-06-11T00:40:59.317983+02:00 wordpress: Authentication attempt from 194. ... show more Detected by WP fail2ban 2026-06-11T00:40:59.317983+02:00 wordpress: Authentication attempt from 194.99.27.111 show less	Brute-Force Web App Attack
🇩🇪 4server	2026-06-09 18:39:28 (1 day ago)	[TueJun0920:39:22.4776572026][security2:error][pid3317401:tid3317452][client194.99.27.111:0]ModSecur ... show more [TueJun0920:39:22.4776572026][security2:error][pid3317401:tid3317452][client194.99.27.111:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.restaurantgandria.ch\"][uri\"/xmlrpc.php\"][unique_id\"aihd2n90zzvgAhTDnbV29wAAAEU\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 london2038.com	2026-06-09 05:49:36 (1 day ago)	Detected by WP fail2ban 2026-06-09T07:49:35.555431+02:00 wordpress: Authentication attempt from 194. ... show more Detected by WP fail2ban 2026-06-09T07:49:35.555431+02:00 wordpress: Authentication attempt from 194.99.27.111 show less	Brute-Force Web App Attack
🇧🇪 Saec	2026-06-09 03:45:11 (1 day ago)	Jarvis auto-ban: CF honeypot path /xmlrpc.php (3× on saec.me)	Port Scan Web App Attack
🇩🇪 HandyTreff.de	2026-05-27 19:51:53 (2 weeks ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -39.773 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -39.773 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 show less	Web App Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-14 18:55:13 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 194.99.27.111 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 194.99.27.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 14 14:55:08.790552 2026] [security2:error] [pid 1491079:tid 1491079] [client 194.99.27.111:19637] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|compliancedepts.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "compliancedepts.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad6NjNWUW7esD1uMXCarVQAAAA4"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Mainpine	2026-04-13 08:25:59 (1 month ago)	probing for vulnerable web apps	Web App Attack
🇺🇸 TPI-Abuse	2026-04-11 20:35:41 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 194.99.27.111 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 194.99.27.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 16:35:37.897216 2026] [security2:error] [pid 3207993:tid 3207993] [client 194.99.27.111:58965] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|primacomm.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "primacomm.com"] [uri "/"] [unique_id "adqwmepLcSZOWi-JIp4NdQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 Cognisant-Security	2026-04-08 08:41:00 (2 months ago)	Attempts to login WordPress with invalid admin credentials	Web App Attack
🇺🇸 TRoden	2026-04-08 03:19:38 (2 months ago)	Geo Block Plugin: Escalation flag(s): rce_attempt	Hacking
Anonymous	2026-03-18 11:17:55 (2 months ago)	Aggressive web scan	Web App Attack
🇲🇹 Malta	2026-02-17 20:13:15 (3 months ago)	194.99.27.111 - - [17/Feb/2026:21:13:14 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows N ... show more 194.99.27.111 - - [17/Feb/2026:21:13:14 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Hacking Web App Attack VPN IP
🇩🇪 spyra.rocks	2025-04-29 20:05:06 (1 year ago)	WordPress Firewall	Web App Attack
🇩🇪 spyra.rocks	2025-04-25 08:05:07 (1 year ago)	WordPress Firewall	Web App Attack
🇩🇪 spyra.rocks	2025-04-22 22:05:10 (1 year ago)	WordPress Firewall	Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.30

🇲🇽 189.250.42.192

🇳🇱 176.65.149.27

🇪🇬 156.197.199.179

🇺🇸 150.107.38.210

🇫🇮 147.185.133.192

🇫🇷 84.247.169.208

🇭🇰 65.181.79.60

🇱🇹 45.227.254.170

🇧🇷 45.205.1.70

🇹🇬 156.38.73.89

🇱🇾 154.127.68.71

🇨🇳 117.72.64.105

🇺🇸 91.230.168.120

🇳🇱 20.190.160.14

🇺🇸 20.168.122.60

🇺🇸 150.107.38.132

🇰🇷 125.135.130.230

🇹🇭 118.193.56.184

🇵🇱 91.198.89.37