JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 212.98.91.91

212.98.91.91 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 61%: ?

61%

ISP	Rezolved ApS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS42525
Domain Name	rezolved.net
Country	🇩🇰 Denmark
City	Copenhagen, Capital Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 212.98.91.91

Whois 212.98.91.91

IP Abuse Reports for 212.98.91.91:

This IP address has been reported a total of 35 times from 20 distinct sources. 212.98.91.91 was first reported on December 11th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 crispi	2026-06-18 09:32:36 (1 day ago)	Port scan from 212.98.91.91	Port Scan
🇦🇺 MAGIC	2026-06-16 05:05:19 (3 days ago)	VM5 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇦🇺 bius.dev	2026-06-15 23:58:20 (3 days ago)	Too many comments via the contact form at https://bius.dev/contact. Tuesday 16th of June 2026 09:58: ... show more Too many comments via the contact form at https://bius.dev/contact. Tuesday 16th of June 2026 09:58:20 AM - 212.98.91.91 show less	Web Spam
Anonymous	2026-06-15 15:58:01 (4 days ago)	Malicious activity detected	Hacking Web App Attack
🇸🇪 teskedsgumman.se	2026-06-04 04:39:00 (2 weeks ago)	content scraper	Bad Web Bot
🇩🇰 RhQM	2026-06-03 08:04:16 (2 weeks ago)		Bad Web Bot Exploited Host Web App Attack
🇺🇸 rsa	2026-05-27 15:22:00 (3 weeks ago)	excessive crawling ddos	DDoS Attack Bad Web Bot Web App Attack
Anonymous	2026-05-27 07:55:08 (3 weeks ago)	SuspiciousBot Activity detected by FMBAD System 2026-05-27 10:55:08	Port Scan Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 16:56:57 (3 weeks ago)	(mod_security) mod_security (id:217291) triggered by 212.98.91.91 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:217291) triggered by 212.98.91.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 12:56:53.775278 2026] [security2:error] [pid 3032:tid 3032] [client 212.98.91.91:59625] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(\\\\n\|\\\\r)" at ARGS_NAMES:\\r\\nfromwhere. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "145"] [id "217291"] [rev "2"] [msg "HTTP Header Injection Attack via payload (CR/LF detected)\|\|scruffware.com\|F\|2"] [data "Matched Data: \\x0d found within ARGS_NAMES:\\x5cr\\x5cnfromwhere: \\x0d\\x0afromwhere"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "scruffware.com"] [uri "/g12terms.php"] [unique_id "ahR_Vbk4PdXxXsHzTYbKJgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-05-25 10:19:15 (3 weeks ago)	tcp/443 (4 or more attempts)	Port Scan
🇺🇸 TPI-Abuse	2026-05-24 20:12:10 (3 weeks ago)	(mod_security) mod_security (id:210730) triggered by 212.98.91.91 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 212.98.91.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 16:12:06.243922 2026] [security2:error] [pid 29375:tid 29375] [client 212.98.91.91:49394] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|dalessalesandservice.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dalessalesandservice.com"] [uri "/[email protected]"] [unique_id "ahNblnykOLbWMYxa1FVYywAAACk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-24 00:09:04 (3 weeks ago)	(mod_security) mod_security (id:217291) triggered by 212.98.91.91 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:217291) triggered by 212.98.91.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 20:08:57.069846 2026] [security2:error] [pid 16099:tid 16099] [client 212.98.91.91:51675] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(\\\\n\|\\\\r)" at ARGS_NAMES:\\r\\nfromwhere. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "145"] [id "217291"] [rev "2"] [msg "HTTP Header Injection Attack via payload (CR/LF detected)\|\|briancastle.com\|F\|2"] [data "Matched Data: \\x0d found within ARGS_NAMES:\\x5cr\\x5cnfromwhere: \\x0d\\x0afromwhere"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "briancastle.com"] [uri "/g12terms.php"] [unique_id "ahJBmbdjE8VsAxjMQPGLJwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-05-22 01:05:10 (4 weeks ago)	Request Overload (104)	Brute-Force Web App Attack
🇺🇸 LotPhantom	2026-05-20 01:54:50 (4 weeks ago)	2026/05/20 01:54:49 [error] 2972646#2972646: 35171 connect() failed (111: Connection refused) while ... show more 2026/05/20 01:54:49 [error] 2972646#2972646: 35171 connect() failed (111: Connection refused) while connecting to upstream, client: 212.98.91.91, server: wynnesmiles.com, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:4001/", host: "wynnesmiles.com" ... show less	Web App Attack
Anonymous	2026-05-18 04:53:10 (1 month ago)	Rate limit bad session: 3 in 2s (Magento Site) (Botnet activity attributed to: Angara Technologies G ... show more Rate limit bad session: 3 in 2s (Magento Site) (Botnet activity attributed to: Angara Technologies Group / mikhail-smirnov-79830322) show less	Hacking

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 103.195.238.51

🇺🇸 50.46.141.125

🇮🇳 27.123.104.42

🇵🇱 185.201.113.170

🇨🇦 172.217.45.27

🇺🇿 94.158.49.223

🇳🇱 91.92.40.49

🇩🇪 44.157.213.62

🇺🇸 20.38.42.22

🇨🇳 221.224.159.220

🇺🇦 188.163.113.186

🇩🇪 167.94.146.71

🇧🇷 138.36.48.224

🇺🇸 44.71.117.61

🇬🇧 5.226.140.49

🇧🇷 205.210.31.240

🇮🇳 203.192.232.180

🇮🇳 182.95.27.94

🇫🇮 147.185.133.109

🇨🇳 119.96.223.148