JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

91.200.101.138

Neutral Activity

Abuse confidence score ?

0% Low Risk

163 reports

98 reporters · latest 3 months ago

ISP	DeinServerHost Prem
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213250
Domain Name	deinserverhost.de
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

91.200.101.138 has been reported 163 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 91.200.101.138

Export CSV

This IP address has been reported a total of 163 times from 98 distinct sources. 91.200.101.138 was first reported on January 22nd 2026, and the most recent report was 3 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-06-29 10:48:52 (3 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇮🇳 evicky2002	2026-06-29 04:52:15 (3 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇫🇷 Dampen59	2026-05-30 08:19:00 (4 months ago)	(cpanel) Failed cPanel login from 91.200.101.138 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; ... show more (cpanel) Failed cPanel login from 91.200.101.138 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-05-30 08:18:54 +0000] info [whostmgrd] 91.200.101.138 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-30 08:18:55 +0000] info [whostmgrd] 91.200.101.138 - root "GET /cpsess9274415936/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-30 08:18:55 +0000] info [whostmgrd] 91.200.101.138 - root "GET /cpsess9274415936/json-api/listaccts?api.version=1&limit=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-30 08:18:55 +0000] info [whostmgrd] 91.200.101.138 - root "GET /cpsess9274415936/json-api/accountsummary?user=root HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-30 08:18:55 +0000] info [cpaneld] 91.200.101.138 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld show less	Port Scan
🇬🇧 Oakley	2026-05-28 07:12:59 (4 months ago)	(cpanel) Failed cPanel login from 91.200.101.138 (DE/Germany/-): 5 in the last 900 secs	Hacking
🇪🇸 masterguru	2026-05-25 06:17:01 (4 months ago)	(cpanel) Failed cPanel login from 91.200.101.138 (DE/Germany/-): 5 in the last 3600 secs (0-123)	Hacking
🇩🇪 phil2k	2026-05-24 20:56:09 (4 months ago)	ICMP + TCP & UDP portscan on multiple ports : Firewall: Within 2026-05-21 11:26:35 - 2026-05-21 11:2 ... show more ICMP + TCP & UDP portscan on multiple ports : Firewall: Within 2026-05-21 11:26:35 - 2026-05-21 11:26:36 CEST(+0200) identified: unallowed access from 91.200.101.138/32 on port 2087(tcp:2087) (1 trial) Fail2ban: Within 2026-05-21 11:26:35 - 2026-05-21 11:26:37 CEST(+0200) banned: 6 times by fail2ban[firewall]; 6 times by fail2ban[recidive] show less	Port Scan Ping of Death
🇭🇺 kranem	2026-05-24 12:00:19 (4 months ago)	Triggered Cloudflare WAF from DE. Action taken: BLOCK ASN: 213250 (Dominic Scholz trading as ITP-Sol ... show more Triggered Cloudflare WAF from DE. Action taken: BLOCK ASN: 213250 (Dominic Scholz trading as ITP-Solutions GmbH & Co. KG) Protocol: HTTP/1.1 (GET method) Endpoint: /openid_connect/cpanelid Timestamp: 2026-05-24T11:34:12Z User-Agent: python-requests/2.32.5 show less	Bad Web Bot
🇺🇸 Matthew Ping	2026-05-24 04:30:02 (4 months ago)	cPanel/WHM brute force blocked by CSF/LFD on d865.	Web App Attack Brute-Force
🇲🇾 Rizzy	2026-05-23 06:44:55 (4 months ago)	Multiple failed cPanel logins	Web App Attack
🇫🇷 masterguru	2026-05-22 08:21:35 (4 months ago)	Port Scan detected from 91.200.101.138 (DE/Germany/-). 11 hits in the last 71 seconds (0-197)	Port Scan
🇮🇩 David Koswari	2026-05-22 05:34:00 (4 months ago)	REQ_BLOCKED_ACL	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted
🇫🇷 Dampen59	2026-05-22 04:07:38 (4 months ago)	(cpanel) Failed cPanel login from 91.200.101.138 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; ... show more (cpanel) Failed cPanel login from 91.200.101.138 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CPANEL; Logs: [2026-05-21 23:07:34 -0500] info [whostmgrd] 91.200.101.138 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-21 23:07:34 -0500] info [whostmgrd] 91.200.101.138 - root "GET /cpsess5642712985/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-21 23:07:34 -0500] info [whostmgrd] 91.200.101.138 - root "GET /cpsess5642712985/json-api/listaccts?api.version=1&limit=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-21 23:07:34 -0500] info [whostmgrd] 91.200.101.138 - root "GET /cpsess5642712985/json-api/accountsummary?user=root HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect [2026-05-21 23:07:35 -0500] info [cpaneld] 91.200.101.138 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld show less	Port Scan
🇩🇪 phil2k	2026-05-21 09:26:39 (4 months ago)	fail2ban:firewall:2026-05-21T11:26:35.767474+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> ... show more fail2ban:firewall:2026-05-21T11:26:35.767474+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=91.200.101.138 DST=<PRIVATE_IPv4> LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=2164 DF PROTO=TCP SPT=64747 DPT=2087 WINDOW=64240 RES=0x00 CWR ECE SYN URGP=0 2026-05-21T11:26:36.286488+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=91.200.101.138 DST=<PRIVATE_IPv4> LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=2165 DF PROTO=TCP SPT=64747 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0 show less	DDoS Attack Port Scan
🇳🇱 Roderic	2026-05-18 15:00:43 (4 months ago)	Port Scan detected from 91.200.101.138 (DE/Germany/Hesse/Frankfurt am Main/-/[redacted]).	Port Scan
🇩🇪 london2038.com	2026-05-14 17:05:34 (4 months ago)	Connection atttempts against closed TCP ports May 14 19:05:24 BLOCK SRC=91.200.101.138 LEN=52 TOS=0x ... show more Connection atttempts against closed TCP ports May 14 19:05:24 BLOCK SRC=91.200.101.138 LEN=52 TOS=0x02 PREC=0x00 TTL=119 ID=43478 DF PROTO=TCP SPT=56628 DPT=2087 WINDOW=64240 RES=0x00 CWR ECE SYN May 14 19:05:27 BLOCK SRC=91.200.101.138 LEN=52 TOS=0x02 PREC=0x00 TTL=119 ID=43479 DF PROTO=TCP SPT=56628 DPT=2087 WINDOW=64240 RES=0x00 CWR ECE SYN May 14 19:05:33 BLOCK SRC=91.200.101.138 LEN=52 TOS=0x00 PREC=0x00 TTL=119 ID=43480 DF PROTO=TCP SPT=56628 DPT=2087 WINDOW=64240 RES=0x00 SYN show less	Port Scan

Showing 1 to 15 of 163 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 102.220.163.101

🇳🇱 45.148.10.141

🇸🇬 34.143.134.100

🇵🇰 2400:adcc:1c1:2200:d19a:37d8:f1d5:ddee

🇷🇸 188.2.107.36

🇫🇷 91.231.89.41

🇱🇹 62.60.130.253

🇮🇩 36.67.227.241

🇩🇪 35.246.136.15

🇺🇸 16.216.88.167

🇸🇪 2.249.150.53

🇱🇧 185.104.71.74

🇳🇱 178.62.197.51

🇺🇸 172.237.136.85

🇭🇰 118.193.32.88

🇨🇳 116.179.33.148

🇺🇸 107.173.85.94

🇺🇸 34.48.195.165

🇺🇸 24.23.125.83

🇲🇴 182.93.50.90