JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 217.21.90.62

217.21.90.62 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 100%: ?

100%

ISP	TerraTransit AG
Usage Type	Data Center/Web Hosting/Transit
ASN	AS47583
Domain Name	terratransit.de
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 217.21.90.62

Whois 217.21.90.62

IP Abuse Reports for 217.21.90.62:

This IP address has been reported a total of 36 times from 28 distinct sources. 217.21.90.62 was first reported on June 6th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 Burayot	2026-06-08 11:02:56 (4 days ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 217.21.90.62 (IN/India/-): 2 in the ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 217.21.90.62 (IN/India/-): 2 in the last 3600 secs show less	Web App Attack
🇳🇱 ReyhZhao	2026-06-08 07:42:12 (4 days ago)	Multiple ModSecurity blocks detected from a single source IP, including a restricted file access att ... show more Multiple ModSecurity blocks detected from a single source IP, including a restricted file access attempt and disallowed request content types. show less	Brute-Force
🇮🇩 Burayot	2026-06-08 05:35:39 (4 days ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 217.21.90.62 (IN/India/-): 1 in the ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 217.21.90.62 (IN/India/-): 1 in the last 3600 secs show less	Web App Attack
Anonymous	2026-06-08 05:22:38 (4 days ago)	PSCSERV WPSCAN 217.21.90.62	Bad Web Bot Web App Attack
🇩🇪 Bedios GmbH	2026-06-08 02:56:17 (5 days ago)	Login credentials theft attempt	Hacking
🇨🇭 YF	2026-06-08 01:05:08 (5 days ago)	404 errors Vulnerability scan	Web App Attack
🇬🇧 consul.to	2026-06-08 01:04:45 (5 days ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-06-08 00:20:50 (5 days ago)	(caddyscan) Scanner path probe from 217.21.90.62 (IN/India/-): 5 in the last 3600 secs; Ports: ; Di ... show more (caddyscan) Scanner path probe from 217.21.90.62 (IN/India/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 217.21.90.62 - - [08/Jun/2026:00:20:46 +0000] "GET /api/.env.save HTTP/1.1" [REDACTED] 200 2627 217.21.90.62 - - [08/Jun/2026:00:20:46 +0000] "GET /app/.env HTTP/1.1" [REDACTED] 200 2627 217.21.90.62 - - [08/Jun/2026:00:20:46 +0000] "GET /.env.save HTTP/1.1" [REDACTED] 200 2627 217.21.90.62 - - [08/Jun/2026:00:20:46 +0000] "GET /core/.env HTTP/1.1" [REDACTED] 200 2627 217.21.90.62 - - [08/Jun/2026:00:20:46 +0000] "GET /api/.env HTTP/1.1" show less	Port Scan
🇧🇪 voormedia	2026-06-07 22:20:03 (5 days ago)	Accessed trap at '/.env'	Web App Attack
🇳🇱 homeshowdomain.nl	2026-06-07 22:07:54 (5 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-06. show less	Web App Attack SSH Hacking
🇺🇸 ANTI SCANNER	2026-06-07 20:21:45 (5 days ago)	Scanner : /laravel/.env	Web Spam
🇳🇿 Tripwire	2026-06-07 11:42:41 (5 days ago)	Scanning for exploits - /members/.env	Web App Attack
🇩🇪 Vegascosmetics	2026-06-07 10:31:29 (5 days ago)	Kingcopy(AI-IDS) Report: IP automatically blocked after attack pattern. Vegas Security System	Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-06-07 09:15:11 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 217.21.90.62 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 217.21.90.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 05:15:06.014569 2026] [security2:error] [pid 12132:tid 12132] [client 217.21.90.62:24964] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "americashealthtalk.com"] [uri "/laravel/.env"] [unique_id "aiU2mg-5QKXVpRCP6oALuQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-07 06:05:10 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 217.21.90.62 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 217.21.90.62 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 02:05:05.848240 2026] [security2:error] [pid 23076:tid 23076] [client 217.21.90.62:22394] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clarktec.com"] [uri "/dev/.env"] [unique_id "aiUKESiV4ZiAB-nW8XUc2gAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.186

🇩🇪 213.209.159.238

🇧🇴 181.188.187.140

🇺🇸 173.239.240.12

🇸🇪 138.124.29.146

🇻🇳 125.212.244.35

🇨🇳 117.50.174.180

🇫🇷 91.231.89.195

🇺🇸 44.42.93.89

🇹🇼 192.178.36.157

🇳🇱 185.242.226.104

🇺🇸 147.185.132.51

🇫🇮 138.124.5.60

🇪🇸 79.117.225.206

🇮🇩 36.83.132.158

🇨🇳 8.152.161.33

🇩🇪 134.122.93.100

🇺🇸 104.168.162.165

🇮🇩 103.41.247.76

🇺🇸 45.156.129.169