This IP address has been reported a total of
42
times from
21 distinct
sources.
66.90.105.138 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[17/Sep/2026:08:12:08 +0300] -- 66.90.105.138 Ban reason: Scanner [CMS_GENERIC] | Request: GET /admi ...
show more[17/Sep/2026:08:12:08 +0300] -- 66.90.105.138 Ban reason: Scanner [CMS_GENERIC] | Request: GET /administrator/manifests/packages/pkg_sourcerer.xml HTTP/1.1
show less
[ThuSep1703:38:18.0577282026][security2:error][pid3780207:tid3780286][client66.90.105.138:0]ModSecur ...
show more[ThuSep1703:38:18.0577282026][security2:error][pid3780207:tid3780286][client66.90.105.138:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"4hosts.net\"][uri\"/plugins/system/jce/jce.xml\"][unique_id\"aqtEikTGR2djRp0d1uIOaQAAAUQ\"]
show less
[WedSep1616:49:11.3873442026][security2:error][pid832153:tid832276][client66.90.105.138:0]ModSecurit ...
show more[WedSep1616:49:11.3873442026][security2:error][pid832153:tid832276][client66.90.105.138:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"admin-services.ch\"][uri\"/wp-content/plugins/wpmudev-updates/changelog.txt\"][unique_id\"aqqsZyJsvsb1BVoX_0QRkwAAAAY\"]
show less
Walking a list of paths that do not exist (scanning) | method: GET | path: /admin/ | 2026-09-16 09:3 ...
show moreWalking a list of paths that do not exist (scanning) | method: GET | path: /admin/ | 2026-09-16 09:32 UTC
show less
Reason:15 (Hacking), Via: bomenrooien.com/connectors/system/phpthumb.php, Message: [POST] Path Trave ...
show moreReason:15 (Hacking), Via: bomenrooien.com/connectors/system/phpthumb.php, Message: [POST] Path Traversal (../) in Value in 'cache_filename' [+35]; Gevaarlijk woord 'eval' in Value in 'IMresizedData' [+35]; Verdachte string 'base64_decode' in Value in 'IMresizedData' [+20]; Code injectie (PHP statement) in Value in 'IMresizedData' [+35]; Combinatiebonus [+10][RAW_BODY] Gevaarlijk woord 'eval' in Value in 'payload' [+35]; Verdachte string 'base64_decode' in Value in 'payload' [+20]; Path Traversal (../) in Value in 'payload' [+35]; Code injectie (PHP statement) in Value in 'payl
show less
[TueSep1504:35:41.7723152026][security2:error][pid3215107:tid3215333][client66.90.105.138:0]ModSecur ...
show more[TueSep1504:35:41.7723152026][security2:error][pid3215107:tid3215333][client66.90.105.138:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"aid-consultancy.com\"][uri\"/media/sourcerer/js/popup.js\"][unique_id\"aqiu_WCQJo1O2BkCf0cTUAAAAQ8\"]
show less
Hacking
Web App Attack
Showing 1 to
15
of 42 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩