JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

92.113.18.28

Neutral Activity

Abuse Confidence Score

0% Low Risk

63 reports

24 reporters · latest 5 months ago

ISP: JSC Ukrtelecom
Usage Type: Data Center/Web Hosting/Transit
ASN: AS47583
Domain Name: ukrtelecom.ua
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

92.113.18.28 has been reported 63 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

63 from 24 distinct reporters

First reported

May 31st 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-06-02 18:47:47 UTC · (5 months ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-06-02 15:44:12 UTC · (5 months ago)	(caddyscan) Scanner path probe from 92.113.18.28 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:15:44:10 +0000] "GET /core/.env HTTP/1.1" [REDACT ... show more (caddyscan) Scanner path probe from 92.113.18.28 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:15:44:10 +0000] "GET /core/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:15:44:10 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:15:44:10 +0000] "GET /app/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:15:44:10 +0000] "GET /api/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:15:44:10 +0000] "GET /member/.env HTTP/1.1" show less	Port Scan
🇫🇷 masterguru	2026-06-02 11:39:24 UTC · (5 months ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-197)	Hacking Web App Attack
Anonymous	2026-06-02 10:20:32 UTC · (5 months ago)	(caddyscan) Scanner path probe from 92.113.18.28 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:10:20:29 +0000] "GET /backend/.env HTTP/1.1" [RED ... show more (caddyscan) Scanner path probe from 92.113.18.28 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:10:20:29 +0000] "GET /backend/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:10:20:29 +0000] "GET /member/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:10:20:29 +0000] "GET /api/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:10:20:29 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:10:20:29 +0000] "GET /dev/.env HTTP/1.1" show less	Port Scan
🇫🇷 masterguru	2026-06-02 09:42:15 UTC · (5 months ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 09:25:35 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 05:25:32.617044 2026] [security2:error] [pid 19330:tid 19330] [client 92.113.18.28:46334] Mod ... show more (mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 05:25:32.617044 2026] [security2:error] [pid 19330:tid 19330] [client 92.113.18.28:46334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ssl-grp.com"] [uri "/dev/.env"] [unique_id "ah6hjK7xzeo8nBOnydL5SAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 08:16:42 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 04:16:38.382573 2026] [security2:error] [pid 19624:tid 19624] [client 92.113.18.28:42762] Mod ... show more (mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 04:16:38.382573 2026] [security2:error] [pid 19624:tid 19624] [client 92.113.18.28:42762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "usoilinc.com"] [uri "/core/.env"] [unique_id "ah6RZuceANh4sycpJYcXnwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-02 05:54:27 UTC · (5 months ago)	(caddyscan) Scanner path probe from 92.113.18.28 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:05:54:24 +0000] "GET /.env HTTP/1.1" [REDACTED] 2 ... show more (caddyscan) Scanner path probe from 92.113.18.28 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:05:54:24 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:05:54:24 +0000] "GET /app/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:05:54:24 +0000] "GET /member/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:05:54:24 +0000] "GET /dev/.env HTTP/1.1" [REDACTED] 200 2627 92.113.18.28 - - [02/Jun/2026:05:54:24 +0000] "GET /backend/.env HTTP/1.1" show less	Port Scan
🇫🇷 masterguru	2026-06-02 05:31:04 UTC · (5 months ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-195)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 04:28:52 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:28:45.101257 2026] [security2:error] [pid 26335:tid 26335] [client 92.113.18.28:58934] Mod ... show more (mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:28:45.101257 2026] [security2:error] [pid 26335:tid 26335] [client 92.113.18.28:58934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "advantstudio.com"] [uri "/.env"] [unique_id "ah5b_T1L0YzNF55daVxZmgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 n2nguyenn2nguyen	2026-06-02 02:59:59 UTC · (5 months ago)	Blocked by YFC Security on https://brixzly.com — type: directory_scan_attempts	Web App Attack
🇳🇱 e.fierstra	2026-06-02 02:21:49 UTC · (5 months ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
Anonymous	2026-06-02 01:19:02 UTC · (5 months ago)	Bot / scanning and/or hacking attempts: GET /api/.env HTTP/1.1, GET /admin/.env HTTP/1.1, GET /new/.env HTTP/1.1, GET /member/.env HTTP/1.1	Hacking Web App Attack
🇺🇸 antlac1	2026-06-01 22:51:20 UTC · (5 months ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-01 21:54:24 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 17:54:18.782073 2026] [security2:error] [pid 19288:tid 19288] [client 92.113.18.28:49454] Mod ... show more (mod_security) mod_security (id:210492) triggered by 92.113.18.28 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 17:54:18.782073 2026] [security2:error] [pid 19288:tid 19288] [client 92.113.18.28:49454] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "heavenly-creatures.com"] [uri "/api/.env"] [unique_id "ah3_ivqhE6rSxfMxcqSEIAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 63 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 194.88.98.106

🇺🇸 71.6.134.204

🇦🇺 210.0.90.81

🇧🇷 152.241.67.114

🇸🇬 114.119.130.210

🇵🇱 104.164.44.204

🇫🇷 85.217.140.13

🇺🇸 24.42.200.116

🇺🇸 20.65.218.2

🇨🇳 221.228.203.3

🇺🇸 162.216.149.143

🇺🇸 158.94.187.69

🇿🇦 156.155.22.74

🇻🇳 116.100.0.231

🇳🇱 77.239.124.152

🇨🇦 64.119.219.214

🇺🇸 34.48.200.125

🇺🇸 192.207.105.196

🇳🇱 77.239.124.33

🇩🇪 31.56.19.215