JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.134.53.153

91.134.53.153 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 0%: ?

ISP	OVH SAS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Hostname(s)	ns3253141.ip-91-134-53.eu
Domain Name	ovh.net
Country	🇫🇷 France
City	Dunkirk, Hauts-de-France

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.134.53.153

Whois 91.134.53.153

IP Abuse Reports for 91.134.53.153:

This IP address has been reported a total of 44 times from 22 distinct sources. 91.134.53.153 was first reported on May 8th 2025, and the most recent report was 6 months ago.

Old Reports: The most recent abuse report for this IP address is from 6 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 Delta Juliet	2025-12-17 17:26:30 (6 months ago)	Exploit scanner detected	Hacking Web App Attack
🇧🇪 cmbplf	2025-09-25 17:59:14 (9 months ago)	19.501 requests in 1 hour (1mo1w5dfromnow)	Brute-Force Bad Web Bot
Anonymous	2025-09-25 17:51:07 (9 months ago)	Infected user bad webscan	Exploited Host
🇩🇪 www.Examensfragen.de	2025-09-22 11:21:02 (9 months ago)		Web Spam Bad Web Bot
🇩🇪 www.Examensfragen.de	2025-09-15 19:01:50 (9 months ago)		Web Spam Bad Web Bot
🇺🇸 technojoe99	2025-09-14 11:06:36 (9 months ago)	Exploit scan from 91.134.53.153. GET /.env HTTP/1.1.	Web App Attack
🇺🇸 TPI-Abuse	2025-09-13 18:50:31 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 91.134.53.153 (ns3243897.ip-91-134-53.eu): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 91.134.53.153 (ns3243897.ip-91-134-53.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 13 14:50:27.702186 2025] [security2:error] [pid 7246:tid 7246] [client 91.134.53.153:63369] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rimworld.com"] [uri "/notra//.env"] [unique_id "aMW88w_ZnEF-i5lMWLv2IAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-12 14:47:45 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 91.134.53.153 (ns3243897.ip-91-134-53.eu): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 91.134.53.153 (ns3243897.ip-91-134-53.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 12 10:47:37.563110 2025] [security2:error] [pid 1009228:tid 1009247] [client 91.134.53.153:60331] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "la.productions"] [uri "/.env"] [unique_id "aMQyiTT5O1L0NHwvdqNstAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 www.Examensfragen.de	2025-09-10 08:57:46 (10 months ago)		Web Spam Bad Web Bot
🇩🇪 neckaralb-admin.de	2025-09-08 18:34:52 (10 months ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇬🇧 Sloth	2025-09-01 08:42:00 (10 months ago)	2025/09/01 02:00:35 [error] 8448#8448: 767 access forbidden by rule, client: 91.134.53.153, server: ... show more 2025/09/01 02:00:35 [error] 8448#8448: 767 access forbidden by rule, client: 91.134.53.153, server: [REDACTED], request: "GET /.env HTTP/2.0", host: "[REDACTED]" show less	Bad Web Bot Exploited Host Web App Attack
Anonymous	2025-09-01 01:34:44 (10 months ago)	Infected user bad webscan	Exploited Host
🇺🇸 TPI-Abuse	2025-08-30 22:35:17 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 91.134.53.153 (ns3243897.ip-91-134-53.eu): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 91.134.53.153 (ns3243897.ip-91-134-53.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 30 18:35:08.983633 2025] [security2:error] [pid 3043:tid 3043] [client 91.134.53.153:64668] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "travelingguitarfoundation.org"] [uri "/.env"] [unique_id "aLN8nOX5BQgYTf3p_apObQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 MF Network	2025-08-30 14:42:52 (10 months ago)	Bad Calls: Webpage scraping, Web App Attack	Bad Web Bot Exploited Host Web App Attack
Anonymous	2025-08-26 23:29:20 (10 months ago)	Legion Credential Harvester / SMTP Hijacker: /.env	Hacking Web App Attack

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 203.172.235.32

🇺🇿 194.55.92.41

🇩🇪 178.254.44.60

🇮🇹 178.251.73.254

🇺🇸 172.190.89.127

🇨🇳 120.48.78.121

🇳🇱 85.17.180.81

🇺🇸 34.75.157.168

🇩🇪 213.209.159.223

🇧🇷 179.125.180.16

🇺🇸 150.107.38.138

🇺🇸 143.42.1.71

🇺🇸 66.55.80.161

🇨🇳 60.184.133.62

🇬🇧 45.82.76.109

🇺🇸 20.163.13.222

🇺🇦 5.252.154.55

🇺🇸 2600:3c03::2000:53ff:fef9:9ffa

🇺🇸 173.255.193.160

🇸🇬 152.42.192.96