Total reports
8 from
6 distinct
reporters
First reported
November 11th 2026
Most recent report
6 hours ago
Last 60 days
Top reporter locations
🇺🇸
United States of America
3
🇩🇪
Germany
2
🇫🇷
France
1
Most common categories
Web App Attack
8
Bad Web Bot
3
Brute-Force
3
Exploited Host
1
Hacking
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇳🇱
homeshowdomain.nl
2026-11-12 22:59:16
UTC ·
(6 hours ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-11.
Web App Attack
SSH
Hacking
🇫🇷
service Informatique
2026-11-12 04:00:37
UTC ·
(1 day ago)
GET /.env
Web App Attack
🇩🇪
FeG Deutschland
2026-11-11 17:53:37
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 14:59:49
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 54.92.198.90 (ec2-54-92-198-90.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:59:41.203853 2026] [security2:error] [pid 26457:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 54.92.198.90 (ec2-54-92-198-90.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:59:41.203853 2026] [security2:error] [pid 26457:tid 26457] [client 54.92.198.90:33976] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.twinls.com"] [uri "/.env"] [unique_id "avSC3YcHeW_vG7figiUm3wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 14:44:45
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 54.92.198.90 (ec2-54-92-198-90.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:44:39.334472 2026] [security2:error] [pid 9565:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 54.92.198.90 (ec2-54-92-198-90.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 09:44:39.334472 2026] [security2:error] [pid 9565:tid 9565] [client 54.92.198.90:20234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cmcnyc.com"] [uri "/.env"] [unique_id "avR_VzqJLZmoV6A2G_f87AAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-11 14:38:13
UTC ·
(1 day ago)
GET /.env HTTP/1.1
...
Web App Attack
🇩🇪
pltcldvlpr
2026-11-11 14:09:34
UTC ·
(1 day ago)
CMS/framework probe: 54.92.198.90 - - [11/Nov/2026:15:09:34 +0100] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" asn=14618 org="Amazon.com, Inc." count ...
show more
CMS/framework probe: 54.92.198.90 - - [11/Nov/2026:15:09:34 +0100] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" asn=14618 org="Amazon.com, Inc." country=US
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 13:59:16
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 54.92.198.90 (ec2-54-92-198-90.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:59:12.337036 2026] [security2:error] [pid 26412:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 54.92.198.90 (ec2-54-92-198-90.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:59:12.337036 2026] [security2:error] [pid 26412:tid 26412] [client 54.92.198.90:58456] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pcmechanic.com"] [uri "/.env"] [unique_id "avR0sCYcbKlo2DJUVG8K7QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
