This IP address has been reported a total of
36
times from
28 distinct
sources.
194.5.49.92 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 10
reports;
United States of America
with 4
reports;
Belgium
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
18
times;
Brute-Force
15
times;
Hacking
7
times;
Bad Web Bot
7
times;
Port Scan
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[WedOct2801:44:37.8109902026][security2:error][pid434968:tid434979][client194.5.49.92:0]ModSecurity: ...
show more[WedOct2801:44:37.8109902026][security2:error][pid434968:tid434979][client194.5.49.92:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"gmint.ch\"][uri\"/xmlrpc.php\"][unique_id\"auFFdZaZAdHAiMqfC1TzNQAAAEc\"]
show less
194.5.49.92 - - [28/Oct/2026:00:32:20 +0100] "POST /xmlrpc.php HTTP/1.1" 200 837 "-" "Mozilla/5.0 (M ...
show more194.5.49.92 - - [28/Oct/2026:00:32:20 +0100] "POST /xmlrpc.php HTTP/1.1" 200 837 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 194.5.49.92 - - [28/Oct/2026:00:32:20 +0100] "POST /xmlrpc.php HTTP/1.1" 200 837 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 194.5.49.92 - - [28/Oct/2026:00:32:20 +0100] "POST /xmlrpc.php HTTP/1.1" 200 837 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
show less
Brute-Force
Web App Attack
Anonymous
Blocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-lo ...
show moreBlocked by web application firewall: automated malicious HTTP requests (WordPress xmlrpc.php / wp-login brute-force and admin-panel scanning). Distributed botnet / automated tooling. No legitimate use.
show less
{"ClientAddr":"194.5.49.92:39281","ClientHost":"194.5.49.92","ClientPort":"39281","ClientUsername":" ...
show more{"ClientAddr":"194.5.49.92:39281","ClientHost":"194.5.49.92","ClientPort":"39281","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":115862207,"OriginContentSize":418,"OriginDuration":109948067,"OriginStatus":403,"Overhead":5914140,"RequestAddr":"www.cleveradmin.de","RequestContentSize":188,"RequestCount":12588,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-10-27T23:07:19.25006301+01:00","StartUTC":"2026-10-27T22:07:19.25006301Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-10-27T23:07:19+01:00"}
{"ClientAddr":"194.5.49.92:37019","ClientHost":"194.5.49.92","ClientPort":"37019","Client
...
show less
