Maybe the detection was based on:

The Windows Intrusion Detection System!
Home | Search

all alerts with 91.227.122.90/32 as: Source | Destination | Source/Destination
show: Unique Alerts | Portscan Events
Registry lookup (whois) in: ARIN | RIPE | APNIC | LACNIC
external: DNS | whois | Extended whois | DShield.org IP Info | TrustedSource.org IP Info | ISC Source/Subnet Report
91.227.122.90
FQDN: (no DNS resolution attempted) ( local whois )
Num of
Sensors Occurances
as Src. Occurances
as Dest. First
Occurrence Last
Occurrence
1 27 27 2013-02-07 05:47:11 2013-04-20 20:53:01

Alert Group Maintenance | Cache & Status | Administration
BASE 1.4.5 (lilias) (by Kevin Johnson and the BASE Project Team
Built on ACID by Roman Danyliw )

[Loaded in 0 seconds]

Also alerted at: http://www.miltonstart.com/
358 websites share the same IP: http://sameid.net/ip/91.227.122.90/
For IP issues see latest reports: http://urlquery.net/report.php?id=2531579

polonus