JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 131.108.76.8

131.108.76.8

Recent Activity

14 reports found in our database

24% ▲ ▲ ▲ Elevated

Abuse confidence score ?

ISP

Tecnet Info Telecom

Usage Type

Fixed Line ISP

ASN

AS61666

Hostname(s)

131-108-76-8.tecnetinfotelecom.com.br

Domain Name

tecnetinfotelecom.com.br

Country

🇧🇷 Brazil

City

Santa Rosa, Rio Grande do Sul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 131.108.76.8:

This IP address has been reported a total of 14 times from 11 distinct sources. 131.108.76.8 was first reported on July 27th 2025, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: United States of America with 4 reports; Germany with 1 report; Italy with 1 report. The most common categories in these recent reports were: Bad Web Bot 5 times; Web App Attack 3 times; Brute-Force 3 times; DDoS Attack 2 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 lenz	2026-09-01 06:36:34 (1 day ago)	Sep 1 08:35:51 hosting wordpress(grupa-ddd.pl)[1212]: XML-RPC authentication failure for admin from ... show more Sep 1 08:35:51 hosting wordpress(grupa-ddd.pl)[1212]: XML-RPC authentication failure for admin from 131.108.76.8 Sep 1 08:36:01 hosting wordpress(grupa-ddd.pl)[6251]: XML-RPC authentication failure for admin from 131.108.76.8 Sep 1 08:36:12 hosting wordpress(grupa-ddd.pl)[1213]: XML-RPC authentication failure for admin from 131.108.76.8 Sep 1 08:36:23 hosting wordpress(grupa-ddd.pl)[10315]: XML-RPC authentication failure for admin from 131.108.76.8 Sep 1 08:36:34 hosting wordpress(grupa-ddd.pl)[1216]: XML-RPC authentication failure for admin from 131.108.76.8 ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 07:20:43 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 131.108.76.8 (131-108-76-8.tecnetinfotelecom.co ... show more (mod_security) mod_security (id:240335) triggered by 131.108.76.8 (131-108-76-8.tecnetinfotelecom.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 03:20:35.353903 2026] [security2:error] [pid 3062:tid 3062] [client 131.108.76.8:1746] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 131.108.76.8 (+1 hits since last alert)\|insidemilb.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "insidemilb.com"] [uri "/xmlrpc.php"] [unique_id "ao1CQw4IJWU9geFilwmCfQAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 06:21:36 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 131.108.76.8 (131-108-76-8.tecnetinfotelecom.co ... show more (mod_security) mod_security (id:240335) triggered by 131.108.76.8 (131-108-76-8.tecnetinfotelecom.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 02:21:30.233341 2026] [security2:error] [pid 25022:tid 25022] [client 131.108.76.8:2789] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 131.108.76.8 (+1 hits since last alert)\|webuydinwiddiehouses.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "webuydinwiddiehouses.com"] [uri "/xmlrpc.php"] [unique_id "ao00aq8JLAnjTzC3psgPuAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 A000Z	2026-08-18 01:47:45 (2 weeks ago)	Fail2Ban: 131.108.76.8 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 ... show more Fail2Ban: 131.108.76.8 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-07-31 20:30:59 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-07-16 23:11:55 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-18 21:28:11 (2 months ago)	(mod_security) mod_security (id:217210) triggered by 131.108.76.8 (131-108-76-8.tecnetinfotelecom.co ... show more (mod_security) mod_security (id:217210) triggered by 131.108.76.8 (131-108-76-8.tecnetinfotelecom.com.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 17:28:05.713634 2026] [security2:error] [pid 16782:tid 16782] [client 131.108.76.8:36674] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|ca33pages.shop\|F\|4"] [data "GET http://ca33pages.shop HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ca33pages.shop"] [uri "/"] [unique_id "ajRi5atv6feZS9pao8uNGQAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 hermawan	2026-06-09 20:55:59 (2 months ago)	[Wed Jun 10 03:55:54.197967 2026] [security2:error] [pid 291129:tid 139736378140352] [client 131.108 ... show more [Wed Jun 10 03:55:54.197967 2026] [security2:error] [pid 291129:tid 139736378140352] [client 131.108.76.8:35458] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "582"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:Referer: https://www.bmkg.go.id/ request_line = GET / HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "aih92tBVZ7sLLZEYD_RpCgACDRg"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[291154] [qe9KWhjOtAo] [aih92tBVZ7sLLZEYD_RpCgACDRg] keep_alive=[1] [2026-06-10 03:55:54.197973] [R:aih92tBVZ7sLLZEYD_RpCgACDRg] UA:'Mozilla/5.0 (Linux; Android 8.0.0; LG-H870DS Build/OPR1.170623.032) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36' Host:'staklim-jatim.bmkg.g ... show less	Email Spam Hacking
Anonymous	2026-02-26 05:39:32 (6 months ago)	Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ... show more Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in email-link.asp show less	Exploited Host Bad Web Bot
🇮🇹 VHosting	2025-12-24 00:20:28 (8 months ago)	Detected attack and reported by a human	DDoS Attack Brute-Force Bad Web Bot Exploited Host Web App Attack SSH
🇨🇭 backslash	2025-11-23 07:20:14 (9 months ago)	block ruleset A5EE6C8F745F0934168261886A3817E5C386412A	Bad Web Bot
Anonymous	2025-11-19 04:01:34 (9 months ago)	scanning http requests from known botnet	Web App Attack
🇳🇱 exxos	2025-08-31 08:03:01 (1 year ago)	Attacks with Bad user agents	Hacking
🇪🇸 Global Cyber Police	2025-07-27 18:24:41 (1 year ago)	Malicious bot activity detected: Hitting honeypot page (200 OK with 258/259 bytes sent).	Port Scan Brute-Force Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4023:1009::12a

🇮🇩 163.7.6.74

🇧🇷 131.196.46.67

🇧🇷 131.196.44.115

🇫🇷 91.231.89.9

🇨🇦 85.217.149.66

🇪🇸 5.182.83.231

🇦🇷 186.22.76.44

🇺🇸 173.26.221.65

🇸🇬 159.223.79.203

🇳🇵 157.10.100.12

🇨🇳 119.99.166.37

🇺🇸 104.28.247.220

🇺🇸 104.28.247.219

🇻🇳 103.74.116.219

🇷🇴 89.32.41.53

🇫🇷 85.217.140.1

🇹🇼 35.201.136.76

🇺🇸 20.171.192.73

🇨🇳 223.109.252.160