JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

91.234.6.117

Neutral Activity

Abuse Confidence Score

0% Low Risk

44 reports

38 reporters · latest 6 months ago

ISP: SOLLUTIUM EU Sp z.o.o.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS30860
Hostname(s): dedicated.vsys.host
Domain Name: sollutium.com
Country: 🇺🇦 Ukraine
City: Kyiv, Kyiv City

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

91.234.6.117 has been reported 44 times. The most recent report is from 6 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

44 from 38 distinct reporters

First reported

April 5th 2026

Most recent report

6 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-04-30 13:04:10 UTC · (6 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 patrisei	2026-04-06 11:01:56 UTC · (7 months ago)	CrowdSec Drop is better than Reject: crowdsecurity/http-sensitive-files	Port Scan Web App Attack
🇷🇺 DZBOT	2026-04-06 10:51:14 UTC · (7 months ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇩🇪 webanyone	2026-04-06 09:46:01 UTC · (7 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇩🇪 sec_af	2026-04-06 09:25:09 UTC · (7 months ago)	Automated web scanner detected on prod215. 13 suspicious HTTP requests (403/404/503) within 10 minutes. Scanning for config files (.env, .git), PHP shells, CMS vulnerabilities. Network: UA-VSYS 91.234.4.0 - 91.234.7.255. Blocked at firewall + Varnish ... show more Automated web scanner detected on prod215. 13 suspicious HTTP requests (403/404/503) within 10 minutes. Scanning for config files (.env, .git), PHP shells, CMS vulnerabilities. Network: UA-VSYS 91.234.4.0 - 91.234.7.255. Blocked at firewall + Varnish level. show less	Brute-Force Web App Attack
🇦🇹 René Hickersberger	2026-04-06 08:19:28 UTC · (7 months ago)	malicious bot detected: violations="hit-honeypot"; user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"	Web App Attack
🇨🇭 dalslab ltd	2026-04-06 08:13:19 UTC · (7 months ago)	[06/Apr/2026:10:13:09 +0200] - 404 404 - GET https git.dalslab.com "/.env.old" [Client 91.234.6.117] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" [06/Apr/2026:10:13:10 +0200] - 404 404 - ... show more [06/Apr/2026:10:13:09 +0200] - 404 404 - GET https git.dalslab.com "/.env.old" [Client 91.234.6.117] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" [06/Apr/2026:10:13:10 +0200] - 404 404 - GET https git.dalslab.com "/.env.example" [Client 91.234.6.117] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" [06/Apr/2026:10:13:11 +0200] - 404 404 - GET https git.dalslab.com "/.env.save" [Client 91.234.6.117] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" [06/Apr/2026:10:13:18 +0200] - 404 404 - GET https git.dalslab.com "/core/.env" [Client 91.234.6.117] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" [06/Apr/2026:10:13:19 +0200] - 404 404 - GET https git.dalslab.com "/api/.env" [Client 91.234.6.117] [Length 11] [Gzip -] [Sent-to 10.1.1.40] "Mozilla/5.0 (Wi ... show less	Web Spam Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-06 07:37:22 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 91.234.6.117 (dedicated.vsys.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 03:37:17.712513 2026] [security2:error] [pid 22463:tid 22463] [client 91.23 ... show more (mod_security) mod_security (id:210492) triggered by 91.234.6.117 (dedicated.vsys.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 03:37:17.712513 2026] [security2:error] [pid 22463:tid 22463] [client 91.234.6.117:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gibit.me"] [uri "/.env.example"] [unique_id "adNireWVOfZWP9779wCUJwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-04-06 07:10:21 UTC · (7 months ago)	[MonApr0609:10:16.0359802026][security2:error][pid3722537:tid3722549][client91.234.6.117:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htacce ... show more [MonApr0609:10:16.0359802026][security2:error][pid3722537:tid3722549][client91.234.6.117:0]ModSecurity:Accessdeniedwithcode403\(phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"98\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"ggarchitetti.ch.136-243-54-122.cpanel.site\"][uri\"/.env.bak\"][unique_id\"adNcWMPEHtsJ28ESzuNVwwAAAIk\"] show less	Port Scan Brute-Force Web App Attack
🇦🇹 mindrider	2026-04-06 05:39:58 UTC · (7 months ago)	91.234.6.117 - - [06/Apr/2026:07:39:52 +0200] "GET /.env.staging HTTP/1.1" 404 2968 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" 91.234.6.117 - - [06/Apr/2026:07:39:53 +0200] "GET /.env.backup HTTP/1.1" 404 2968 "-" "Mozilla ... show more 91.234.6.117 - - [06/Apr/2026:07:39:52 +0200] "GET /.env.staging HTTP/1.1" 404 2968 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" 91.234.6.117 - - [06/Apr/2026:07:39:53 +0200] "GET /.env.backup HTTP/1.1" 404 2968 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" 91.234.6.117 - - [06/Apr/2026:07:39:54 +0200] "GET /.env.bak HTTP/1.1" 404 2968 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" ... show less	Brute-Force Web App Attack
🇳🇱 BlueWire Hosting	2026-04-06 05:26:43 UTC · (7 months ago)	Probing websites for vulnerabilities	Web App Attack
🇺🇸 TPI-Abuse	2026-04-06 05:13:47 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 91.234.6.117 (dedicated.vsys.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 01:13:41.227515 2026] [security2:error] [pid 15594:tid 15594] [client 91.23 ... show more (mod_security) mod_security (id:210492) triggered by 91.234.6.117 (dedicated.vsys.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 01:13:41.227515 2026] [security2:error] [pid 15594:tid 15594] [client 91.234.6.117:40095] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "genericevent.com"] [uri "/.env.staging"] [unique_id "adNBBcOXcBs2y_Ahnp8QigAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-04-06 05:04:15 UTC · (7 months ago)	2026-04-06 @ 07:04:15 (CET) ~ Blocked for trying to access: /.env.bak	Web App Attack
🇺🇸 TPI-Abuse	2026-04-06 04:54:35 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 91.234.6.117 (dedicated.vsys.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 00:54:28.217545 2026] [security2:error] [pid 10836:tid 10836] [client 91.23 ... show more (mod_security) mod_security (id:210492) triggered by 91.234.6.117 (dedicated.vsys.host): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 00:54:28.217545 2026] [security2:error] [pid 10836:tid 10836] [client 91.234.6.117:44061] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gegkal.com"] [uri "/.env.backup"] [unique_id "adM8hHsyqZI3UiM8H6qmxQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-04-06 04:53:01 UTC · (7 months ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 180.153.236.31

🇩🇪 151.243.11.133

🇸🇬 146.190.87.85

🇮🇩 103.94.164.111

🇷🇴 80.94.92.179

🇩🇪 23.132.164.185

🇺🇸 2604:a880:400:d1:0:5:6dab:2001

🇸🇪 217.211.15.160

🇮🇩 202.46.28.143

🇳🇱 192.42.116.104

🇧🇷 191.53.9.12

🇮🇳 168.144.116.211

🇪🇨 157.100.140.149

🇨🇴 152.200.181.42

🇳🇱 45.148.10.151

🇨🇳 36.33.167.165

🇳🇱 35.214.233.177

🇩🇪 185.168.30.166

🇨🇳 43.226.37.21

🇺🇸 2604:a880:400:d1:0:5:6d61:8001