JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 93.113.25.109

93.113.25.109 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 34%: ?

34%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	SimpliQ Tech SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS215659
Hostname(s)	tor-exit.ro.2cb.li
Domain Name	maghost.ro
Country	🇷🇴 Romania
City	Popesti-Leordeni, Ilfov

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 93.113.25.109

Whois 93.113.25.109

IP Abuse Reports for 93.113.25.109:

This IP address has been reported a total of 56 times from 40 distinct sources. 93.113.25.109 was first reported on October 2nd 2024, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇱🇹 SaturdayNightLive	2026-06-14 23:59:21 (19 hours ago)	Port scan on 46721	Port Scan Hacking
🇩🇪 4server	2026-05-28 19:08:25 (2 weeks ago)	[ThuMay2821:08:18.5410922026][security2:error][pid1069455:tid1069621][client93.113.25.109:0]ModSecur ... show more [ThuMay2821:08:18.5410922026][security2:error][pid1069455:tid1069621][client93.113.25.109:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"risanamento-funghi-muffa.ch\"][uri\"/dump.sql\"][unique_id\"ahiSotDLZD0RZRz2aCZN1wAAAQg\"]\,referer:risanamento-funghi-muffa.ch/dump.sql show less	Port Scan Brute-Force Web App Attack
🇩🇪 LRob.fr	2026-05-27 13:45:12 (2 weeks ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
🇧🇪 taivas.nl	2026-05-12 22:02:15 (1 month ago)	Bad_requests	Bad Web Bot
🇩🇪 FeG Deutschland	2026-05-12 08:51:29 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
Anonymous	2026-05-11 15:43:50 (1 month ago)	93.113.25.109 - - [11/May/2026:15:43:49 +0000] "GET /bothole/stinkwell.php?f=4%27%29%20AND%207188%3D ... show more 93.113.25.109 - - [11/May/2026:15:43:49 +0000] "GET /bothole/stinkwell.php?f=4%27%29%20AND%207188%3DCAST%28%28CHR%28113%29%7C%7CCHR%28118%29%7C%7CCHR%2898%29%7C%7CCHR%2898%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%287188%3D7188%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%7C%7CCHR%28107%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29%20AND%20%28%27MgwR%27%3D%27MgwR&start=50 HTTP/1.1" 307 6647 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15" ... show less	SQL Injection
🇺🇸 Rip	2026-05-09 05:14:41 (1 month ago)	403 Errors: Access Forbidden	Brute-Force
🇩🇪 big-cloud.nl	2026-05-07 11:59:48 (1 month ago)	Try to access /xmlrpc.php	Web App Attack
🇦🇺 oncord	2026-05-05 03:41:03 (1 month ago)	Form spam	Web Spam
🇦🇺 oncord	2026-05-01 05:19:00 (1 month ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-04-24 05:33:07 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 93.113.25.109 (tor-exit.ro.2cb.li): 1 in the la ... show more (mod_security) mod_security (id:210831) triggered by 93.113.25.109 (tor-exit.ro.2cb.li): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 01:33:00.031938 2026] [security2:error] [pid 6351:tid 6351] [client 93.113.25.109:52760] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.varnadorefamily.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.varnadorefamily.com"] [uri "/"] [unique_id "aesAjDK6jszvqW2buOGHpQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2026-04-20 19:57:37 (1 month ago)		DDoS Attack
🇳🇱 MaasSec	2026-04-17 19:30:07 (1 month ago)	SSH honeypot activity (Romania): 1 failed SSH login(s); 1 successful honeypot login(s); 1 tunnel att ... show more SSH honeypot activity (Romania): 1 failed SSH login(s); 1 successful honeypot login(s); 1 tunnel attempt(s). Reported by Maassec Honeynet (maassec.nl). show less	Hacking Brute-Force SSH
🇺🇸 island-freaks.com	2026-04-17 15:33:27 (1 month ago)	Attack Type: WordPress Exploit Bot attempt on /wp-admin/ \| DNS tor-exit.ro.2cb.li \| Agent: Mozilla/5 ... show more Attack Type: WordPress Exploit Bot attempt on /wp-admin/ \| DNS tor-exit.ro.2cb.li \| Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 show less	Port Scan Hacking Bad Web Bot Exploited Host Web App Attack
🇫🇷 ✨	2026-04-15 00:16:12 (2 months ago)	Rule : PLESK BOT 2026-04-15 01:53:24 Unauthorized login attempt to Plesk Panel from IP 93.113.25.109 ... show more Rule : PLESK BOT 2026-04-15 01:53:24 Unauthorized login attempt to Plesk Panel from IP 93.113.25.109 with username admin show less	Hacking Brute-Force Web App Attack

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 123.58.212.28

🇰🇷 110.14.190.221

🇧🇬 91.148.190.150

🇺🇸 216.25.89.101

🇨🇳 175.174.77.59

🇨🇳 112.113.108.64

🇺🇸 107.150.101.136

🇩🇪 82.165.109.70

🇫🇮 80.66.83.80

🇱🇹 45.227.254.170

🇳🇱 20.160.86.7

🇧🇪 198.235.24.221

🇬🇧 159.65.94.135

🇯🇵 152.32.201.11

🇺🇸 136.118.198.233

🇺🇸 64.37.63.170

🇫🇷 51.68.34.131

🇭🇰 23.91.97.170

🇺🇸 18.190.15.50

🇨🇳 8.136.56.76