JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 107.189.31.134

107.189.31.134 was found in our database!

This IP was reported 4,105 times. Confidence of Abuse is 0%: ?

ISP	BuyVM
Usage Type	Data Center/Web Hosting/Transit
ASN	AS53667
Hostname(s)	tor.reichsfunkma.st
Domain Name	frantech.ca
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 107.189.31.134

Whois 107.189.31.134

IP Abuse Reports for 107.189.31.134:

This IP address has been reported a total of 4,105 times from 718 distinct sources. 107.189.31.134 was first reported on February 9th 2022, and the most recent report was 2 years ago.

Old Reports: The most recent abuse report for this IP address is from 2 years ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Linuxmalwarehuntingnl	2024-07-01 10:35:39 (2 years ago)	Unauthorized connection attempt	Brute-Force
🇳🇱 Linuxmalwarehuntingnl	2024-06-28 22:46:37 (2 years ago)	Honeypot HIT	Brute-Force
🇺🇸 Misaka13514	2024-06-03 03:50:12 (2 years ago)	l7ddos on s.apeiria.net	DDoS Attack
🇩🇪 NxtGenIT	2024-06-02 11:16:03 (2 years ago)	107.189.31.134 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Atte ... show more 107.189.31.134 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt show less	Brute-Force
🇺🇸 oncord	2024-06-02 06:14:43 (2 years ago)	Form spam	Web Spam
🇲🇾 Rizzy	2024-06-01 15:54:42 (2 years ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-05-30 14:04:48 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 107.189.31.134 (tor.reichsfunkma.st): 1 in the ... show more (mod_security) mod_security (id:210730) triggered by 107.189.31.134 (tor.reichsfunkma.st): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 30 10:04:42.348957 2024] [security2:error] [pid 16910:tid 47046716647168] [client 107.189.31.134:34408] [client 107.189.31.134] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|illianaphotobooth.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "illianaphotobooth.com"] [uri "/config.bak"] [unique_id "ZliHevGuu8AnN4jLhLHNBwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 ozisp.com.au	2024-05-29 21:08:25 (2 years ago)	US_FranTech BuyVM_<33>1717016904 [1:2522007:5539] ET TOR Known Tor Relay/Router (Not Exit) Node TCP ... show more US_FranTech BuyVM_<33>1717016904 [1:2522007:5539] ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic group 8 [Classification: Misc Attack] [Priority: 2] {TCP} 107.189.31.134:50584 show less	Open Proxy
🇨🇿 lp	2024-05-29 07:53:11 (2 years ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 107.189.31.134 2024-05-29T08:32:17+02 ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 107.189.31.134 2024-05-29T08:32:17+02:00 vpn Access-Reject 'edison' station: 107.189.31.134 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-05-28 17:09:43 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 107.189.31.134 (tor.reichsfunkma.st): 1 in the ... show more (mod_security) mod_security (id:210730) triggered by 107.189.31.134 (tor.reichsfunkma.st): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 28 13:09:37.838750 2024] [security2:error] [pid 4623] [client 107.189.31.134:42596] [client 107.189.31.134] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|fitnessdoctors.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fitnessdoctors.com"] [uri "/fitnessdoc.sql"] [unique_id "ZlYP0Y8dmXlWXKp4iukx-QAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Tha_14	2024-05-28 06:40:39 (2 years ago)	Limit on login attempts is reached	Brute-Force
🇺🇸 TPI-Abuse	2024-05-28 05:22:40 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 107.189.31.134 (tor.reichsfunkma.st): 1 in the ... show more (mod_security) mod_security (id:210730) triggered by 107.189.31.134 (tor.reichsfunkma.st): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 28 01:22:34.111985 2024] [security2:error] [pid 27551:tid 47960035800832] [client 107.189.31.134:50678] [client 107.189.31.134] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|daraluz.net\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "daraluz.net"] [uri "/daily.sql"] [unique_id "ZlVqGsThT9YPiEBfGkqldgAAAQA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 NxtGenIT	2024-05-27 13:38:17 (2 years ago)	107.189.31.134 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Atte ... show more 107.189.31.134 has been observed attacking Port 1812. Observed Threat: RADIUS Login Brute Force Attempt show less	Brute-Force
🇺🇸 MPL	2024-05-26 12:42:41 (2 years ago)	tcp/80 (4 or more attempts)	Port Scan
🇩🇪 psauxit	2024-05-26 04:02:23 (2 years ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show more Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Hacking Web App Attack

Showing 1 to 15 of 4105 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 2001:41d0:303:161e::1

🇹🇬 196.170.60.179

🇻🇳 115.74.7.119

🇨🇦 96.1.40.151

🇷🇺 95.165.142.8

🇺🇸 54.240.3.14

🇺🇸 207.90.244.17

🇺🇸 195.184.76.196

🇫🇷 169.58.177.117

🇳🇱 157.245.75.196

🇨🇦 137.184.162.54

🇹🇼 111.70.23.245

🇭🇰 103.43.191.43

🇬🇧 86.154.215.155

🇺🇸 66.164.72.50

🇳🇱 51.158.206.34

🇦🇺 49.194.20.192

🇦🇷 45.230.205.133

🇺🇸 44.215.67.168

🇰🇪 41.89.96.120