JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 87.99.131.94

87.99.131.94 was found in our database!

This IP was reported 61 times. Confidence of Abuse is 100%: ?

100%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213230
Hostname(s)	static.94.131.99.87.clients.your-server.de
Domain Name	hetzner.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 87.99.131.94

Whois 87.99.131.94

IP Abuse Reports for 87.99.131.94:

This IP address has been reported a total of 61 times from 49 distinct sources. 87.99.131.94 was first reported on July 30th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-08-01 03:16:59 (1 hour ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 87.99.131.94 162.158.152.170 - - [30/Jul/2026:17:00 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 87.99.131.94 162.158.152.170 - - [30/Jul/2026:17:00:56 -0300] "GET /.git/config HTTP/1.1" 404 18193 show less	Bad Web Bot
🇳🇱 homeshowdomain.nl	2026-07-31 21:59:55 (6 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-30. show less	Web App Attack SSH Hacking
🇭🇷 bubausluge	2026-07-31 19:58:40 (8 hours ago)	Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 16 attempts, Period: 2026-07-30 22:22 ... show more Blocked by https://aegis.hr — Web Scanner - (MITRE T1595.001), 16 attempts, Period: 2026-07-30 22:22:46 to 2026-07-30 22:22:46 show less	Brute-Force
Anonymous	2026-07-31 16:31:58 (12 hours ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇿🇦 conure	2026-07-31 12:12:46 (16 hours ago)	csagent: score 19.6: secrets grab x2, 404 noise floor x2; 2 domain(s) in 16s	Web App Attack
🇮🇳 evicky2002	2026-07-31 06:00:00 (22 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-30 22:34:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 87.99.131.94 (static.94.131.99.87.clients.your- ... show more (mod_security) mod_security (id:210492) triggered by 87.99.131.94 (static.94.131.99.87.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 18:33:57.263111 2026] [security2:error] [pid 72367:tid 72367] [client 87.99.131.94:16328] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stocks.nautos-usa.com"] [uri "/.git/config"] [unique_id "amvRVW0lewCW900bXFrtqwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 et-a_network	2026-07-30 22:32:03 (1 day ago)	87.99.131.94 - - [30/Jul/2026:22:32:01 +0000] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 ( ... show more 87.99.131.94 - - [30/Jul/2026:22:32:01 +0000] "GET /.git/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0" host=e-pruef.et-a.eu 87.99.131.94 - - [30/Jul/2026:22:32:01 +0000] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0" host=e-pruef.et-a.eu 87.99.131.94 - - [30/Jul/2026:22:32:02 +0000] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0" host=e-pruef.et-a.eu 87.99.131.94 - - [30/Jul/2026:22:32:02 +0000] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0" host=e-pruef.et-a.eu 87.99.131.94 - - [30/Jul/2026:22:32:02 +0000] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/131.0.0.0" host=e-pruef.et-a.eu ... show less	Bad Web Bot Web App Attack
Anonymous	2026-07-30 22:31:06 (1 day ago)	(caddyscan) Scanner path probe from 87.99.131.94 (US/United States/static.94.131.99.87.clients.your- ... show more (caddyscan) Scanner path probe from 87.99.131.94 (US/United States/static.94.131.99.87.clients.your-server.de): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 87.99.131.94 - - [30/Jul/2026:21:53:39 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 87.99.131.94 - - [30/Jul/2026:21:56:00 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 87.99.131.94 - - [30/Jul/2026:22:20:06 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 87.99.131.94 - - [30/Jul/2026:22:22:17 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 87.99.131.94 - - [30/Jul/2026:22:31:00 +0000] "GET /.git/config HTTP/1.1" show less	Port Scan
🇩🇪 Teufel100	2026-07-30 22:26:54 (1 day ago)	ModSecurity rejected a query	Brute-Force Hacking Web App Attack
🇩🇪 Ba-Yu	2026-07-30 22:22:43 (1 day ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-07-30 22:18:11 (1 day ago)	87.99.131.94 - - [30/Jul/2026:16:18:11 -0600] "GET /.git/config HTTP/1.1" 301 441 "-" "Mozilla/5.0 ( ... show more 87.99.131.94 - - [30/Jul/2026:16:18:11 -0600] "GET /.git/config HTTP/1.1" 301 441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 22:16:27 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 87.99.131.94 (static.94.131.99.87.clients.your- ... show more (mod_security) mod_security (id:210492) triggered by 87.99.131.94 (static.94.131.99.87.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 18:16:22.359005 2026] [security2:error] [pid 3012222:tid 3012222] [client 87.99.131.94:16238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "postseason.michaelpmcgrath.com"] [uri "/.git/config"] [unique_id "amvNNskXc8-RvjpDX1WakAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 paissangroup	2026-07-30 22:06:15 (1 day ago)	Multiple WAF Violations	Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-30 21:59:36 (1 day ago)	Auto-ban: >3000 req/min op 2026-07-30	Web App Attack SSH Hacking

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 191.101.59.16

🇩🇪 172.104.241.98

🇰🇷 146.56.164.20

🇧🇪 198.235.24.195

🇮🇳 182.78.86.62

🇺🇸 162.216.150.164

🇨🇦 143.198.44.218

🇻🇳 116.110.150.10

🇲🇾 113.211.212.93

🇻🇳 113.172.122.112

🇷🇺 90.188.245.52

🇺🇦 31.131.31.29

🇰🇷 223.194.21.240

🇩🇪 191.101.118.202

🇺🇦 185.212.251.63

🇿🇦 173.194.171.213

🇺🇸 151.240.67.41

🇺🇸 147.182.136.123

🇨🇳 120.48.84.44

🇮🇷 109.162.249.57