JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.195.136.54

91.195.136.54 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 21%: ?

21%

ISP	MTS OJSC
Usage Type	Fixed Line ISP
ASN	AS43720
Domain Name	mts.ru
Country	🇷🇺 Russian Federation
City	Orel, Oryol oblast

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.195.136.54

Whois 91.195.136.54

IP Abuse Reports for 91.195.136.54:

This IP address has been reported a total of 12 times from 10 distinct sources. 91.195.136.54 was first reported on July 31st 2022, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Hazzard	2026-10-22 22:05:13 (17 hours ago)	(wordpress) Failed wordpress login from 91.195.136.54 (RU/Russia/Oryol oblast/Oryol/-/[redacted]): ... show more (wordpress) Failed wordpress login from 91.195.136.54 (RU/Russia/Oryol oblast/Oryol/-/[redacted]): (CF_ENABLE) show less	Brute-Force
🇺🇸 TPI-Abuse	2026-10-22 16:03:49 (23 hours ago)	(mod_security) mod_security (id:225170) triggered by 91.195.136.54 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.195.136.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 12:03:40.191768 2026] [security2:error] [pid 4603:tid 4603] [client 91.195.136.54:3718] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|genevaatlantic.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "genevaatlantic.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "atoz3G8uNfvNT2eYzJAIJgAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 04:37:16 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 91.195.136.54 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.195.136.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:37:12.837969 2026] [security2:error] [pid 595:tid 595] [client 91.195.136.54:12083] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|realdoctorstories.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "realdoctorstories.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atmS-B1FVSHP-wPWhkEO2AAAAAA"], referer: https://realdoctorstories.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-13 10:46:34 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
Anonymous	2026-08-14 10:27:29 (2 months ago)	2026-08-14T12:27:28.780583+02:00 vps kernel: [3074083.282735] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=f ... show more 2026-08-14T12:27:28.780583+02:00 vps kernel: [3074083.282735] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=91.195.136.54 DST=54.37.14.118 LEN=52 TOS=0x00 PREC=0x00 TTL=110 ID=26591 DF PROTO=TCP SPT=17999 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ... show less	Port Scan Brute-Force
🇹🇷 pamircil	2025-08-02 02:05:03 (1 year ago)	🍯 WinnieThePooh Honeypot : Detected (smbd/445) 💀	Hacking Exploited Host
🇩🇪 Beta	2025-06-05 12:41:50 (1 year ago)	ports, 445/24H:1/7D:2	Port Scan
🇩🇪 Schnuffi	2025-05-30 10:32:02 (1 year ago)	ports, 445/24H:1/7D:2	Port Scan
🇩🇪 Ad0lar	2025-05-27 13:24:46 (1 year ago)	ports, 445/24H:1/7D:1	Port Scan
Anonymous	2025-04-02 10:03:50 (1 year ago)	Ports: 143,993; Direction: 0; Trigger: LF_DISTATTACK	Brute-Force SSH
🇱🇹 NotACaptcha	2023-08-18 07:09:03 (3 years ago)	Unauthorised access (Aug 18 10:09) SRC=91.195.136.54 LEN=52 TTL=117 ID=8065 DF TCP DPT=445 WINDOW=81 ... show more Unauthorised access (Aug 18 10:09) SRC=91.195.136.54 LEN=52 TTL=117 ID=8065 DF TCP DPT=445 WINDOW=8192 SYN show less	Port Scan
🇱🇹 NotACaptcha	2022-07-31 10:44:19 (4 years ago)	Unauthorised access (Jul 31 17:44) SRC=91.195.136.54 LEN=52 TTL=114 ID=14169 DF TCP DPT=445 WINDOW=8 ... show more Unauthorised access (Jul 31 17:44) SRC=91.195.136.54 LEN=52 TTL=114 ID=14169 DF TCP DPT=445 WINDOW=8192 SYN show less	Port Scan

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 217.60.198.3

🇧🇷 205.210.31.226

🇩🇪 109.160.32.127

🇩🇪 109.160.32.118

🇧🇬 78.128.112.6

🇳🇱 77.239.124.145

🇧🇷 45.226.221.187

🇳🇱 45.148.10.157

🇺🇸 23.92.26.77

🇹🇼 2001:b400:e2d8:6d2c:bd06:49cc:a566:5ba1

🇷🇴 193.32.162.164

🇨🇱 191.113.211.229

🇺🇸 170.106.142.71

🇺🇸 161.193.1.170

🇯🇵 161.33.171.124

🇺🇸 134.209.0.77

🇨🇳 113.31.106.187

🇺🇸 104.22.118.45

🇰🇿 89.218.51.222

🇳🇱 77.239.124.48