JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

102.91.105.157

Recent Activity

Abuse confidence score ?

77% Critical

31 reports

29 reporters · latest 4 days ago

ISP	MTN Nigeria
Usage Type	Mobile ISP
ASN	AS29465
Domain Name	mtnnigeria.net
Country	🇳🇬 Nigeria
City	Abuja, FCT

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 102.91.105.157

This IP address has been reported a total of 31 times from 29 distinct sources. 102.91.105.157 was first reported on February 3rd 2025, and the most recent report was 4 days ago. In the last 60 days, the top reporter locations were: Germany with 4 reports; France with 4 reports; Netherlands with 2 reports. The most common categories in these recent reports were: Web App Attack 12 times; Hacking 11 times; Bad Web Bot 7 times; Brute-Force 4 times; Port Scan 3 times; Other 2 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-25 04:55:22 (4 days ago)	(mod_security) mod_security (id:210350) triggered by 102.91.105.157 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 102.91.105.157 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 00:55:16.501800 2026] [security2:error] [pid 4814:tid 4869] [client 102.91.105.157:3167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|upperwilds.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "upperwilds.com"] [uri "/"] [unique_id "arX-tNnVOz0L88mCuDtESwAAAMU"], referer: https://tfchecker.online/dir/backlinks-for-organic-growth-222145 show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-09-20 22:00:37 (1 week ago)	Auto-ban: >3000 req/min op 2026-09-20	Web App Attack SSH Hacking
🇯🇵 Andro	2026-09-20 13:26:00 (1 week ago)	Bad Malicious requests detected against the server. The server security system was not impressed and ... show more Bad Malicious requests detected against the server. The server security system was not impressed and blocked the request. show less	Bad Web Bot Web App Attack Hacking
🇸🇪 vaia.cloud	2026-09-20 06:15:01 (1 week ago)	crowdsecurity/CVE-2017-9841	Brute-Force Web App Attack
🇫🇷 Teufel100	2026-09-20 05:44:13 (1 week ago)	ModSecurity rejected a query	Brute-Force Hacking Web App Attack
🇩🇪 bescared	2026-09-20 05:32:33 (1 week ago)	F2B - Malicious activity detected. URL Probing. -c0423ad6-	Hacking Web App Attack
🇫🇷 masterguru	2026-09-20 05:25:44 (1 week ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-193)	Hacking Bad Web Bot
🇸🇬 anotherwatcher	2026-09-20 04:44:58 (1 week ago)	bad bot	Bad Web Bot
🇬🇧 gurnip	2026-09-20 04:39:38 (1 week ago)	Vulnerability probe of page /.env, not found on server.	Brute-Force Web App Attack
Anonymous	2026-09-20 04:03:35 (1 week ago)	102.91.105.157 46.39.185.24 - [20/Sep/2026:06:03:33 +0200] "GET /.env HTTP/1.1" 301 0 "-" "Mozilla/5 ... show more 102.91.105.157 46.39.185.24 - [20/Sep/2026:06:03:33 +0200] "GET /.env HTTP/1.1" 301 0 "-" "Mozilla/5.0" ... show less	Hacking Web App Attack
🇫🇷 zulzeen	2026-09-20 03:59:14 (1 week ago)	[incypit-web] Banned by Fail2ban (Jail: syswarden-secretshunter)	Hacking Web App Attack Bad Web Bot Port Scan
🇩🇪 Bedios GmbH	2026-09-20 03:54:10 (1 week ago)	Login credentials theft attempt	Hacking
🇺🇦 URAN Publishing Service	2026-09-20 03:35:38 (1 week ago)	[20/Sep/2026:06:35:38 +0300] -- 102.91.105.157 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET ... show more [20/Sep/2026:06:35:38 +0300] -- 102.91.105.157 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /.env HTTP/1.1 show less	Bad Web Bot Web App Attack
🇮🇩 securejdprop	2026-09-20 01:46:50 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO Request to ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO Request to Hidden Environment File - Inbound). show less	Hacking Web App Attack
🇳🇱 Alt255	2026-09-20 01:34:49 (1 week ago)	[ftpbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 102.9 ... show more [ftpbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 102.91.105.157 - - \[20/Sep/2026:03:34:35 +0200\] "GET /.env HTTP/1.1" 404 7415 "-" "Mozilla/5.0 \(Linux\; U\; Android 4.4.2\; en-US\; HM NOTE 1W Build/KOT49H\) AppleWebKit/534.30 \(KHTML, like Gecko\) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 200.31.12.187

🇱🇹 141.98.9.91

🇮🇳 135.235.181.231

🇺🇸 128.241.235.89

🇩🇪 102.220.163.100

🇺🇸 91.230.168.175

🇺🇸 91.230.168.74

🇨🇦 85.217.149.55

🇧🇬 79.124.62.126

🇱🇹 62.60.130.198

🇫🇷 91.196.152.99

🇧🇷 45.205.1.160

🇳🇱 45.148.10.141

🇺🇸 20.84.91.51

🇺🇿 213.230.93.78

🇺🇸 207.90.244.12

🇧🇷 179.48.18.42

🇨🇦 178.128.238.243

🇭🇰 156.225.1.45

🇫🇮 147.185.133.159