AbuseIPDB » 92.246.84.133

92.246.84.133 was found in our database!

This IP was reported 3,034 times. Confidence of Abuse is 89%: ?

89%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	XSServer GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS44592
Domain Name	xsserver.gmbh
Country	Netherlands
City	Lelystad, Flevoland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 92.246.84.133

Whois 92.246.84.133

IP Abuse Reports for 92.246.84.133:

This IP address has been reported a total of 3,034 times from 397 distinct sources. 92.246.84.133 was first reported on November 21st 2020, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
oncord	2025-03-14 00:08:53 (2 days ago)	Form spam	Web Spam
MAGIC	2025-03-13 22:02:13 (2 days ago)	VM5 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Anonymous	2025-03-12 01:21:35 (3 days ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
nyuuzyou	2025-03-11 08:21:32 (4 days ago)	Intensive scraping: /web?s=%22spip.php%3F%22&lang=gd&scraper=mojeek	Bad Web Bot
LRob.fr	2025-03-09 06:30:11 (6 days ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
Pingu	2025-03-09 00:31:07 (6 days ago)	Triggered Cloudflare WAF (l7ddos) from T1. Protocol: HTTP/2 (GET method) Endpoint: /	Bad Web Bot
oncord	2025-03-08 06:42:20 (1 week ago)	Form spam	Web Spam
nationaleventpros.com	2025-03-06 19:57:40 (1 week ago)	WordPress login attempt	Brute-Force
oncord	2025-03-06 13:11:24 (1 week ago)	Form spam	Web Spam
subnetprotocol	2025-03-06 12:54:26 (1 week ago)	06/Mar/2025:13:54:22.114945 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client ... show more06/Mar/2025:13:54:22.114945 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 92.246.84.133] ModSecurity: Warning. Pattern match "(?:(?:\\\\\\\$\|\\\\\\\\[)[a-zA-Z0-9_.$\\\\"'\\\\\\\\[\\\\\\\\](){}/\\\\\\\\s]+(?:\\\\\\\$\|\\\\\\\\])[0-9_.$\\\\"'\\\\\\\\[\\\\\\\\](){}/\\\\\\\\s]\\\\\\\$[a-zA-Z0-9_.$\\\\"'\\\\\\\\[\\\\\\\\](){}/\\\\\\\\s].\\\\\\\$\|\\\\\\\$[\\\\\\\\s]string[\\\\\\\\s]\\\\\\\$[\\\\\\\\s](?:\\\\"\|'))" at ARGS:poids2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "503"] [id "933210"] [msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: (SELECT (CHAR(113) CHAR(118) CHAR(113) CHAR(120) CHAR(113) (SELECT (CASE WHEN (9976=9976) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(113) CHAR(118) CHAR(107) CHAR(113) CHAR(113))) found within ARGS:poids2: AND 9976 IN (SELECT (CHAR(113) CHAR(118) CHAR(113) CHAR(120) CHAR(113) (SELECT (CASE WHEN (9976=9976) THEN CHAR(49) ELS ... show less	Hacking Web App Attack
subnetprotocol	2025-03-05 23:21:40 (1 week ago)	06/Mar/2025:00:21:37.667668 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client ... show more06/Mar/2025:00:21:37.667668 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 92.246.84.133] ModSecurity: Warning. Pattern match "(?i)(?:;\|\\\\\\\\{\|\\\\\\\\\|\|\\\\\\\\\|\\\\\\\\\|\|&\|&&\|\\\\\\\\n\|\\\\\\\\r\|`)\\\\\\\\s[\\\\\\\$,@\\\\\\\\'\\\\"\\\\\\\\s](?:[\\\\\\\\w'\\\\"\\\\\\\\./]+/\|[\\\\\\\\\\\\\\\\'\\\\"\\\\\\\\^]\\\\\\\\w[\\\\\\\\\\\\\\\\'\\\\"\\\\\\\\^]:.\\\\\\\\\\\\\\\\\|[\\\\\\\\^\\\\\\\\.\\\\\\\\w '\\\\"/\\\\\\\\\\\\\\\\]\\\\\\\\\\\\\\\$?[\\\\"\\\\\\\\^](?:s[\\\\"\\\\\\\\^](?:y[\\\\"\\\\\\\\^]s[\\\\"\\\\\\\\^](?:t[\\\\"\\\\\\\\^]e[\\\\"\\\\\\\\^]m[\\\\"\\\\\\\\^](?:p[\\\\"\\\\\\\\^]r[\\\\"\\\\\\\\^]o[\\\\"\\\\\\\\^]p[\\\\"\\\\\\\\^]*e ..." at ARGS:poids2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \|\|(SELECT found within ARGS:poids2: ) AND 5003=CAST((CHR(113)\|\|CHR(113)\|\|CHR(113 ... show less	Hacking Web App Attack
subnetprotocol	2025-03-05 13:40:40 (1 week ago)	05/Mar/2025:14:40:38.225710 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client ... show more05/Mar/2025:14:40:38.225710 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 92.246.84.133] ModSecurity: Warning. Pattern match "(?i)(?:;\|\\\\\\\\{\|\\\\\\\\\|\|\\\\\\\\\|\\\\\\\\\|\|&\|&&\|\\\\\\\\n\|\\\\\\\\r\|`)\\\\\\\\s[\\\\\\\$,@\\\\\\\\'\\\\"\\\\\\\\s](?:[\\\\\\\\w'\\\\"\\\\\\\\./]+/\|[\\\\\\\\\\\\\\\\'\\\\"\\\\\\\\^]\\\\\\\\w[\\\\\\\\\\\\\\\\'\\\\"\\\\\\\\^]:.\\\\\\\\\\\\\\\\\|[\\\\\\\\^\\\\\\\\.\\\\\\\\w '\\\\"/\\\\\\\\\\\\\\\\]\\\\\\\\\\\\\\\$?[\\\\"\\\\\\\\^](?:s[\\\\"\\\\\\\\^](?:y[\\\\"\\\\\\\\^]s[\\\\"\\\\\\\\^](?:t[\\\\"\\\\\\\\^]e[\\\\"\\\\\\\\^]m[\\\\"\\\\\\\\^](?:p[\\\\"\\\\\\\\^]r[\\\\"\\\\\\\\^]o[\\\\"\\\\\\\\^]p[\\\\"\\\\\\\\^]*e ..." at ARGS:yeux. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \|\|(SELECT found within ARGS:yeux: ') AND 5657=CAST((CHR(113)\|\|CHR(118)\|\|CHR(107)\|\| ... show less	Hacking Web App Attack
oncord	2025-03-05 04:54:06 (1 week ago)	Form spam	Web Spam
niceshops.com	2025-03-04 08:56:02 (1 week ago)	Web Attack (Mar 25 09:56:01 ScriptKiddie: request for /administrator/ )	SQL Injection Brute-Force Bad Web Bot Web App Attack
oncord	2025-03-04 02:39:23 (1 week ago)	Form spam	Web Spam