JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.154.113.203

94.154.113.203 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 23%: ?

23%

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46475
Domain Name	finegroupservers.com
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.154.113.203

Whois 94.154.113.203

IP Abuse Reports for 94.154.113.203:

This IP address has been reported a total of 29 times from 14 distinct sources. 94.154.113.203 was first reported on June 9th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-06-09 02:03:17 (1 week ago)	[TueJun0904:03:13.9301462026][security2:error][pid3007335:tid3007827][client94.154.113.203:0]ModSecu ... show more [TueJun0904:03:13.9301462026][security2:error][pid3007335:tid3007827][client94.154.113.203:0]ModSecurity:Accessdeniedwithcode500\(phase2\).Patternmatch\"\(\?:perl.\\\\\\\\\.pl\(\\\\\\\\s\\|\\\\\\\\t\)\\\\\\\\\\;\\|\\\\\\\\\;\(\\\\\\\\s\\|\\\\\\\\t\)\perl.\\\\\\\\\.pl\\|perl\(\?:xpl\\\\\\\\.pl\\|kut\\|viewde\\|httpd\\\\\\\\.txt\)\\|\\\\\\\\./xkernel\\\\\\\\\;\\|/kaiten\\\\\\\\.c\\|/mampus\\\\\\\\\?\ show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 22:34:36 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 94.154.113.203 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 94.154.113.203 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 18:34:30.889034 2026] [security2:error] [pid 26265:tid 26265] [client 94.154.113.203:34389] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "manosentuayuda.imerka.com.mx"] [uri "/.wp-config.php.swp"] [unique_id "ag-IdoBWiNPqd_urdGlcEwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 20:54:42 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 94.154.113.203 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 94.154.113.203 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 16:54:38.171977 2026] [security2:error] [pid 4340:tid 4355] [client 94.154.113.203:23063] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sloveniaflyfishing.com"] [uri "/wp-config.bak"] [unique_id "ag4fjmypN9svpit-8HPQagAAAI0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Matthew Ping	2026-05-20 16:20:57 (1 month ago)	ModSecurity rule 949110 triggered on d865. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇮🇹 [email protected]	2026-05-13 08:23:25 (1 month ago)	[Wed May 13 10:23:25.030568 2026] [authz_core:error] [pid 529799:tid 529915] [client 94.154.113.203: ... show more [Wed May 13 10:23:25.030568 2026] [authz_core:error] [pid 529799:tid 529915] [client 94.154.113.203:49999] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/.wp-config.php.swp show less	Brute-Force Web App Attack
Anonymous	2026-05-04 08:09:51 (1 month ago)	94.154.113.203 - - [04/May/2026:16:09:51 +0800] "GET /outfieldasia.com.sql HTTP/1.1" 301 - "-" "Mozi ... show more 94.154.113.203 - - [04/May/2026:16:09:51 +0800] "GET /outfieldasia.com.sql HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 nationaleventpros.com	2026-05-01 03:06:56 (1 month ago)	vulnerability scan	Web App Attack
🇺🇸 antlac1	2026-04-15 05:12:10 (2 months ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
🇫🇷 masterguru	2026-04-15 03:39:48 (2 months ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇮🇩 BPS-StatisticsIndonesia	2026-01-02 05:44:29 (5 months ago)	WP Login Scan Activities	Web App Attack
🇨🇦 polycoda	2025-12-31 01:19:14 (5 months ago)	📄 Probes for wp-login.php and other inexistent URLs	Hacking Web App Attack
🇮🇩 BPS-StatisticsIndonesia	2025-12-29 12:59:07 (5 months ago)	WP Login Scan Activities	Web App Attack
🇪🇸 el-brujo	2025-12-27 13:36:04 (5 months ago)	[Sat Dec 27 14:36:02.997975 2025] [proxy_fcgi:error] [pid 124880:tid 125017] [remote 94.154.113.203: ... show more [Sat Dec 27 14:36:02.997975 2025] [proxy_fcgi:error] [pid 124880:tid 125017] [remote 94.154.113.203:0] AH01071: Got error 'Primary script unknown\n', referer: https://www.google.com [Sat Dec 27 14:36:03.626111 2025] [proxy_fcgi:error] [pid 124880:tid 125327] [remote 94.154.113.203:0] AH01071: Got error 'Primary script unknown\n', referer: https://www.google.com ... show less	Hacking Web App Attack
🇫🇮 as211431.net	2025-12-26 22:01:56 (5 months ago)	Triggered Cloudflare WAF (firewallCustom) from FI. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from FI. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /wp-login.php UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇸🇪 OnTheEdge	2025-03-12 00:00:42 (1 year ago)	Password spraying. Multiple unauthorized login attempts	Hacking Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 218.62.15.102

🇮🇩 103.154.220.58

🇨🇳 117.81.212.152

🇻🇳 117.5.142.179

🇺🇸 108.181.63.2

🇹🇷 85.117.239.172

🇷🇴 80.94.92.164

🇫🇷 62.72.18.191

🇺🇸 44.203.65.54

🇷🇺 31.173.12.27

🇮🇳 2401:4900:8fef:1554:25d4:f85f:763:4e3d

🇺🇸 209.208.221.230

🇨🇦 209.107.116.185

🇺🇸 142.93.252.40

🇲🇾 121.121.49.249

🇧🇷 45.205.1.76

🇮🇩 202.46.29.90

🇫🇷 194.163.137.135

🇲🇽 187.190.21.121

🇷🇺 178.251.140.3