JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.194.54.240

204.194.54.240 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 77%: ?

77%

ISP	Turing Group Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS140869
Domain Name	turingidc.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.194.54.240

Whois 204.194.54.240

IP Abuse Reports for 204.194.54.240:

This IP address has been reported a total of 21 times from 16 distinct sources. 204.194.54.240 was first reported on May 14th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 mar kla	2026-08-01 22:14:00 (8 hours ago)	Searching for vulnerable scripts	Port Scan Brute-Force Exploited Host Hacking SQL Injection
🇺🇸 TPI-Abuse	2026-08-01 06:53:58 (23 hours ago)	(mod_security) mod_security (id:211190) triggered by 204.194.54.240 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211190) triggered by 204.194.54.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 02:53:53.393846 2026] [security2:error] [pid 1584211:tid 1584211] [client 204.194.54.240:47348] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|vccemail.net\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/?rllh=8707%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM%20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29%23"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vccemail.net"] [uri "/images/"] [unique_id "am2YAZRBBZw4KAQUdIpc6AAAACc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 jcbriar	2026-07-31 14:43:41 (1 day ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇺🇸 nyt	2026-07-31 13:38:32 (1 day ago)	SQLi (boolean), XSS, Path Traversal, Path Traversal	SQL Injection Web App Attack
🇩🇪 raph	2026-07-31 06:15:45 (2 days ago)	[SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%2 ... show more [SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%20and%20\|%20OR%20\|%20or%20).* HTTP/1.1$ show less	SQL Injection
🇫🇷 dynamix	2026-07-31 03:54:21 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-31 02:53:19 (2 days ago)	(mod_security) mod_security (id:211190) triggered by 204.194.54.240 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211190) triggered by 204.194.54.240 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 22:53:12.645581 2026] [security2:error] [pid 2043006:tid 2043006] [client 204.194.54.240:43794] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|sawmat.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /images/?C=D%3BO=A&LIoU=7626%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM%20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29%23"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sawmat.com"] [uri "/images/"] [unique_id "amwOGJ-vHDfrDC-slWyWSQAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-07-30 19:46:05 (2 days ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 204.194.54.240 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 204.194.54.240 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇫🇷 COMAITE	2026-07-30 18:00:58 (2 days ago)	SQL injection attempt from 204.194.54.240.	Web App Attack
🇦🇺 paulshipley.com.au	2026-07-30 13:25:02 (2 days ago)	[Thu Jul 30 23:25:01.124909 2026] [security2:error] [pid 529993] [client 204.194.54.240:40356] [clie ... show more [Thu Jul 30 23:25:01.124909 2026] [security2:error] [pid 529993] [client 204.194.54.240:40356] [client 204.194.54.240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 75)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.id.au"] [uri "/tag/joomla/"] [unique_id "amtQrfLE6h9aMLac7kIq8gAAAAU"] ... show less	Web App Attack
🇺🇸 nyt	2026-07-30 09:16:01 (2 days ago)	SQLi (boolean), XSS, Path Traversal, Path Traversal	SQL Injection Web App Attack
🇫🇷 Sorgin Informatique	2026-07-30 06:09:23 (3 days ago)	nee-7 : Trying access unauthorized files/dir=>/index.php/sources-et-licences-des-images?aRfm=3560%20 ... show more nee-7 : Trying access unauthorized files/dir=>/index.php/sources-et-licences-des-images?aRfm=3560%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%... show less	Hacking
Anonymous	2026-07-29 15:05:38 (3 days ago)	Blocked: Reason='Possible SQL injection activity (3/60 min)'; Requests=3	SQL Injection
🇳🇱 javierin	2026-07-27 07:31:49 (5 days ago)	204.194.54.240 - javierin.com - - [27/Jul/2026:07:31:49 +0000] "GET /tag/imagenes-wordpress/?WPIr=78 ... show more 204.194.54.240 - javierin.com - - [27/Jul/2026:07:31:49 +0000] "GET /tag/imagenes-wordpress/?WPIr=7899%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM%20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29%23 HTTP/1.1" 403 "https://javierin.com/tag/imagenes-wordpress/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" SQLI-BLOCKED ... show less	SQL Injection Web App Attack
🇺🇸 nyt	2026-07-27 04:55:57 (6 days ago)	SQLi (boolean), XSS, Path Traversal, Path Traversal	SQL Injection Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 164.92.199.27

🇺🇸 144.24.42.54

🇮🇳 103.220.16.51

🇬🇧 87.236.176.200

🇺🇸 52.4.229.9

🇫🇮 45.154.244.149

🇺🇸 45.79.8.221

🇳🇱 195.178.110.30

🇺🇸 162.216.150.167

🇺🇸 152.44.33.38

🇫🇮 147.185.133.121

🇫🇮 147.185.133.45

🇺🇸 143.198.235.106

🇨🇳 113.57.185.170

🇷🇺 95.25.151.198

🇫🇷 79.91.251.133

🇹🇷 78.135.83.29

🇰🇷 61.37.150.6

🇦🇷 181.23.57.104

🇺🇸 162.216.150.50