JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 91.99.198.191

91.99.198.191 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 40%: ?

40%

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Hostname(s)	static.191.198.99.91.clients.your-server.de
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 91.99.198.191

Whois 91.99.198.191

IP Abuse Reports for 91.99.198.191:

This IP address has been reported a total of 13 times from 7 distinct sources. 91.99.198.191 was first reported on June 29th 2025, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-07-24 22:12:31 (8 hours ago)	[SatJul2500:12:25.1300162026][security2:error][pid3641496:tid3641549][client91.99.198.191:0]ModSecur ... show more [SatJul2500:12:25.1300162026][security2:error][pid3641496:tid3641549][client91.99.198.191:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"gualandi.ch\"][uri\"/\"][unique_id\"amPjSahJKBRrEHh80x19kwAAAFA\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 4server	2026-07-23 22:31:42 (1 day ago)	[FriJul2400:31:37.6166492026][security2:error][pid2218443:tid2218458][client91.99.198.191:0]ModSecur ... show more [FriJul2400:31:37.6166492026][security2:error][pid2218443:tid2218458][client91.99.198.191:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"cmsolution.ch\"][uri\"/\"][unique_id\"amKWSWnwJ9hNB_R0-62PPAAAAQQ\"] show less	Port Scan Brute-Force Web App Attack
🇦🇺 paulshipley.com.au	2026-07-23 15:27:36 (1 day ago)	[Fri Jul 24 01:27:35.556518 2026] [security2:error] [pid 522240] [client 91.99.198.191:45580] [clien ... show more [Fri Jul 24 01:27:35.556518 2026] [security2:error] [pid 522240] [client 91.99.198.191:45580] [client 91.99.198.191] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/"] [unique_id "amIy53loDBGgLa0vSP_t_QAAAAA"], referer: https://merch247.com.au ... show less	Web App Attack
🇦🇺 svejk	2026-07-23 07:49:00 (1 day ago)	[23/Jul/2026:13:24:54 +0930] "GET / HTTP/1.1" 444 0 ... Ports scanning nuisance/abuse. Ban!	Port Scan Phishing
🇩🇪 4server	2026-07-22 11:47:32 (2 days ago)	[WedJul2213:47:31.2240452026][security2:error][pid367844:tid367935][client91.99.198.191:0]ModSecurit ... show more [WedJul2213:47:31.2240452026][security2:error][pid367844:tid367935][client91.99.198.191:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"parrocchiaditesserete.ch\"][uri\"/\"][unique_id\"amCt06h1uRHln313fzqLnAAAAJU\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 4server	2026-07-22 05:28:18 (3 days ago)	[WedJul2207:28:15.4563682026][security2:error][pid1144173:tid1144526][client91.99.198.191:0]ModSecur ... show more [WedJul2207:28:15.4563682026][security2:error][pid1144173:tid1144526][client91.99.198.191:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"hosting-domain-swiss.ch\"][uri\"/\"][unique_id\"amBU70E6rAGLMbzWS4pAEwAAAVQ\"] show less	Hacking Web App Attack
🇩🇪 HandyTreff.de	2026-07-22 00:01:13 (3 days ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -69.538 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -69.538 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Saf show less	Web App Attack Bad Web Bot
🇦🇺 paulshipley.com.au	2026-07-21 22:34:16 (3 days ago)	[Wed Jul 22 08:34:15.820691 2026] [security2:error] [pid 306155] [client 91.99.198.191:44844] [clien ... show more [Wed Jul 22 08:34:15.820691 2026] [security2:error] [pid 306155] [client 91.99.198.191:44844] [client 91.99.198.191] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.com.au"] [uri "/"] [unique_id "al_z54hQZzA9VCxf4UOSUAAAAAk"], referer: https://brettkaye.com.au ... show less	Web App Attack
🇩🇪 4server	2026-07-21 08:44:01 (3 days ago)	[TueJul2110:43:57.7290612026][security2:error][pid2801944:tid2801963][client91.99.198.191:0]ModSecur ... show more [TueJul2110:43:57.7290612026][security2:error][pid2801944:tid2801963][client91.99.198.191:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"cst-ranghetti.ch\"][uri\"/\"][unique_id\"al8xTaZV-jh8ZXhwuuPONgAAANA\"] show less	Port Scan Brute-Force Web App Attack
🇷🇺 DZBOT	2026-07-21 06:23:23 (4 days ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇮🇩 Burayot	2026-07-20 13:22:07 (4 days ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 91.99.198.191 (DE/Germany/static.191 ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 91.99.198.191 (DE/Germany/static.191.198.99.91.clients.your-server.de): 1 in the last 3600 secs show less	Web App Attack
🇳🇱 Study Bitcoin 🤗	2025-07-02 07:00:20 (1 year ago)	Port probe to tcp/8 (unassigned) [srv127]	Port Scan
🇳🇱 Study Bitcoin 🤗	2025-06-29 11:00:24 (1 year ago)	Port probe to tcp/8 (unassigned) [srv127]	Port Scan

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 158.180.87.26

🇨🇳 153.0.51.252

🇺🇸 147.185.132.249

🇺🇸 147.185.132.240

🇨🇳 123.160.221.179

🇺🇸 64.62.156.94

🇫🇷 51.178.142.35

🇨🇦 216.209.134.80

🇨🇳 211.155.100.9

🇹🇭 161.82.192.171

🇫🇮 147.185.133.24

🇺🇸 147.185.132.234

🇺🇸 147.185.132.227

🇳🇱 91.92.42.227

🇺🇸 65.49.1.139

🇵🇰 39.55.147.164

🇰🇷 222.107.156.227

🇺🇦 195.2.236.218

🇮🇩 163.7.8.118

🇭🇰 156.225.1.108