JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.98.64.1

91.98.64.1 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 100%: ?

100%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	static.1.64.98.91.clients.your-server.de
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.98.64.1

Whois 91.98.64.1

IP Abuse Reports for 91.98.64.1:

This IP address has been reported a total of 34 times from 22 distinct sources. 91.98.64.1 was first reported on July 3rd 2026, and the most recent report was 16 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 dalslab ltd	2026-07-08 04:32:58 (16 minutes ago)	[08/Jul/2026:06:32:57 +0200] - 404 404 - HEAD https ntfy.dalslab.com "/secrets.json" [Client 91.98.6 ... show more [08/Jul/2026:06:32:57 +0200] - 404 404 - HEAD https ntfy.dalslab.com "/secrets.json" [Client 91.98.64.1] [Length 0] [Gzip -] [Sent-to 10.1.1.232] "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" [08/Jul/2026:06:32:57 +0200] - 404 404 - HEAD https ntfy.dalslab.com "/config.json" [Client 91.98.64.1] [Length 0] [Gzip -] [Sent-to 10.1.1.232] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-" [08/Jul/2026:06:32:57 +0200] - 404 404 - HEAD https ntfy.dalslab.com "/.git/HEAD" [Client 91.98.64.1] [Length 0] [Gzip -] [Sent-to 10.1.1.232] "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" "-" [08/Jul/2026:06:32:57 +0200] - 404 404 - HEAD https ntfy.dalslab.com "/.env" [Client 91.98.64.1] [Length 0] [Gzip -] [Sent-to 10.1.1.232] "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/1 ... show less	Web Spam Brute-Force Bad Web Bot Web App Attack
🇫🇷 alpha	2026-07-08 02:44:51 (2 hours ago)	Automated honeypot: scanner probed decoy URL on cdn.aldorand.fr (honeypot decoy)	Bad Web Bot Web App Attack
Anonymous	2026-07-08 00:03:03 (4 hours ago)	Bot / scanning and/or hacking attempts: HEAD /.aws/credentials HTTP/1.1, HEAD /.env HTTP/1.1, HEAD / ... show more Bot / scanning and/or hacking attempts: HEAD /.aws/credentials HTTP/1.1, HEAD /.env HTTP/1.1, HEAD /.env.production HTTP/1.1, HEAD /wp-config.php.bak HTTP/1.1, HEAD /secrets.json HTTP/1.1, HEAD /.git/config HTTP/1.1, HEAD /.dev.vars HTTP/1.1, HEAD /.env.backup HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-07-08 00:01:21 (4 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 91.98.64.1 (DE/Germany/static.1.64.98.9 ... show more (mod_security) mod_security triggered on hostname [redacted] 91.98.64.1 (DE/Germany/static.1.64.98.91.clients.your-server.de) show less	SQL Injection
🇺🇸 infra-monitor	2026-07-07 17:00:03 (11 hours ago)	Automated ban via infra-monitor: crowdsecurity/http-probing, wp-sensitive-paths, suspicious-probe, + ... show more Automated ban via infra-monitor: crowdsecurity/http-probing, wp-sensitive-paths, suspicious-probe, +1 more show less	Port Scan Web App Attack
🇬🇧 consul.to	2026-07-07 15:56:29 (12 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 IRISIO	2026-07-07 12:49:00 (16 hours ago)	scans/SQL injection/spam posts : 125 queries	Web App Attack SQL Injection
🇫🇷 alpha	2026-07-07 02:44:23 (1 day ago)	Automated honeypot: scanner probed decoy URL on cdn.aldorand.fr (honeypot decoy)	Bad Web Bot Web App Attack
🇫🇷 alpha	2026-07-06 02:39:42 (2 days ago)	Automated honeypot: scanner probed decoy URL on cdn.aldorand.fr (honeypot decoy)	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 01:41:17 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 91.98.64.1 (static.1.64.98.91.clients.your-serv ... show more (mod_security) mod_security (id:210492) triggered by 91.98.64.1 (static.1.64.98.91.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 21:41:12.022765 2026] [security2:error] [pid 10299:tid 10299] [client 91.98.64.1:26492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dcmillerjr.com"] [uri "/.env.bak"] [unique_id "aksHuEfKgbDiLksNPC-XkQAAAAM"], referer: https://www.google.com/search?q=autodiscover.dcmillerjr.com show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-07-06 01:13:33 (2 days ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 daveoctober	2026-07-06 01:01:41 (2 days ago)	October Sentinel: honeypot triggered	Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-05 21:59:06 (2 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-04. show less	Web App Attack SSH Hacking
Anonymous	2026-07-05 21:20:39 (2 days ago)	(caddyscan) Scanner path probe from 91.98.64.1 (DE/Germany/static.1.64.98.91.clients.your-server.de) ... show more (caddyscan) Scanner path probe from 91.98.64.1 (DE/Germany/static.1.64.98.91.clients.your-server.de): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 91.98.64.1 - - [05/Jul/2026:21:20:33 +0000] "HEAD /.env.backup HTTP/1.1" [REDACTED] 200 0 91.98.64.1 - - [05/Jul/2026:21:20:33 +0000] "HEAD /.git/HEAD HTTP/1.1" [REDACTED] 200 0 91.98.64.1 - - [05/Jul/2026:21:20:33 +0000] "HEAD /wp-config.php.bak HTTP/1.1" [REDACTED] 200 0 91.98.64.1 - - [05/Jul/2026:21:20:33 +0000] "HEAD /.aws/credentials HTTP/1.1" [REDACTED] 200 0 91.98.64.1 - - [05/Jul/2026:21:20:33 +0000] "HEAD /.git/config HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-05 20:27:23 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 91.98.64.1 (static.1.64.98.91.clients.your-serv ... show more (mod_security) mod_security (id:210492) triggered by 91.98.64.1 (static.1.64.98.91.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 16:27:18.065951 2026] [security2:error] [pid 22139:tid 22166] [client 91.98.64.1:14140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lavotel.com"] [uri "/.env"] [unique_id "akq-Jh08Gq2P8yoU2KEXdwAAAFg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.240

🇺🇸 198.55.98.202

🇳🇱 176.65.148.244

🇺🇸 65.49.1.80

🇳🇱 45.156.128.7

🇺🇸 198.55.98.198

🇺🇸 198.55.98.197

🇷🇺 176.57.76.206

🇺🇸 172.236.228.86

🇺🇸 162.216.150.26

🇳🇱 160.119.71.136

🇨🇳 118.145.247.242

🇳🇱 81.19.216.100

🇺🇸 66.132.186.250

🇦🇺 51.161.128.68

🇧🇷 45.230.167.174

🇳🇱 45.156.128.5

🇩🇪 45.13.225.85

🇺🇸 40.119.26.30

🇺🇸 35.255.69.47