JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.234.25.195

91.234.25.195 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 61%: ?

61%

ISP	FOP Kondratyuk Evgeniy Vladimirovich
Usage Type	Fixed Line ISP
ASN	AS198356
Domain Name	isp.net.ua
Country	🇺🇦 Ukraine
City	Kodyma, Odesa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.234.25.195

Whois 91.234.25.195

IP Abuse Reports for 91.234.25.195:

This IP address has been reported a total of 49 times from 35 distinct sources. 91.234.25.195 was first reported on July 18th 2023, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-16 18:06:33 (10 hours ago)	(mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 14:06:26.837746 2026] [security2:error] [pid 10138:tid 10148] [client 91.234.25.195:6044] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.store.emehache.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.store.emehache.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atJnosamI5C8naJ7ANtxfgAAAQc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-10-16 12:23:32 (16 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇭🇰 CyberFox	2026-10-15 22:49:43 (1 day ago)	57011/udp (1 or more attempts)	Port Scan
🇩🇪 stinpriza	2026-10-15 04:12:10 (2 days ago)	WP Authentication attempt for unknown user	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 22:31:46 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 18:31:43.327764 2026] [security2:error] [pid 7083:tid 7083] [client 91.234.25.195:16579] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|freemanfoundationcle.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "freemanfoundationcle.org"] [uri "/wp-json/wp/v2/users"] [unique_id "atACz-50mo9fr6Sbdh816QAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 17:15:53 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 13:15:48.777702 2026] [security2:error] [pid 23944:tid 23944] [client 91.234.25.195:10804] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.store.newmooncafe.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.store.newmooncafe.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as5nRF6UHi5m7GCkKIE8QAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-10-13 10:57:42 (3 days ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 19:03:52 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 15:03:46.909560 2026] [security2:error] [pid 808:tid 808] [client 91.234.25.195:1407] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|oakglenhouse.com.benchmarkbcs.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "oakglenhouse.com.benchmarkbcs.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ask6kqC8ixRIutXiJEb-fAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 05:26:08 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 91.234.25.195 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 01:26:00.825004 2026] [security2:error] [pid 9147:tid 9147] [client 91.234.25.195:14280] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|josephshv.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "josephshv.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ash66CRmIAlNbJLD6clyjgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-01 22:24:38 (2 weeks ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇩🇪 ksol-hostmaster	2026-10-01 19:26:24 (2 weeks ago)	2026/10/01 21:26:19 [error] 86136#101437: 273233 access forbidden by rule, client: 91.234.25.195, s ... show more 2026/10/01 21:26:19 [error] 86136#101437: 273233 access forbidden by rule, client: 91.234.25.195, server: new.hondaforum.hu, request: "GET /topic/honda-accord/440582/ HTTP/1.1", host: "new.hondaforum.hu" ... show less	Web Spam
🇩🇪 Phenix Info	2026-09-21 12:49:19 (3 weeks ago)	SmallGuard.fr/Prestashop Massive 403	Web App Attack
🇺🇸 鬼影233	2026-09-20 10:33:03 (3 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
Anonymous	2026-09-10 17:54:41 (1 month ago)	Network service scanning detected by FortiGate; source quarantined.	Port Scan
🇧🇷 rotabrrmds	2026-09-09 15:33:44 (1 month ago)	Automated report by Fail2Ban - jail ufw-scan	Port Scan

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇧 185.97.95.213

🇨🇳 120.198.23.233

🇪🇸 46.253.45.10

🇸🇪 46.59.88.232

🇰🇷 221.162.218.85

🇺🇸 195.184.76.187

🇨🇳 183.232.212.197

🇻🇳 117.4.254.98

🇺🇸 100.33.249.226

🇷🇺 87.251.81.76

🇳🇱 77.91.71.11

🇺🇸 64.62.156.162

🇱🇹 62.60.134.212

🇺🇸 40.124.123.217

🇺🇸 172.232.3.17

🇸🇬 165.22.51.61

🇨🇦 85.217.149.61

🇨🇦 85.217.149.13

🇺🇸 72.17.34.38

🇳🇱 45.148.10.157