JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 131.147.142.132

131.147.142.132 was found in our database!

This IP was reported 33 times. Confidence of Abuse is 0%: ?

ISP	So-net Service
Usage Type	Fixed Line ISP
ASN	AS2527
Hostname(s)	fp83938e84.tkyc209.ap.nuro.jp
Domain Name	so-net.ne.jp
Country	🇯🇵 Japan
City	Yokohama, Kanagawa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 131.147.142.132

Whois 131.147.142.132

IP Abuse Reports for 131.147.142.132:

This IP address has been reported a total of 33 times from 17 distinct sources. 131.147.142.132 was first reported on August 19th 2024, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 ReporTR	2026-02-11 09:11:08 (4 months ago)	Repeated malicious activity detected by Fail2Ban jail 'plesk-modsecurity'. TCP connection completed. ... show more Repeated malicious activity detected by Fail2Ban jail 'plesk-modsecurity'. TCP connection completed. IP banned. show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 14:37:21 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp) ... show more (mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 09:37:13.886786 2026] [security2:error] [pid 20333:tid 20333] [client 131.147.142.132:53080] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abogadoparticular.com"] [uri "/.env"] [unique_id "aYtCmYkzcVTyy4DzfMa6pQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-01-29 02:12:35 (4 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-01-28 22:40:38 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp) ... show more (mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 17:40:31.161172 2026] [security2:error] [pid 8834:tid 8834] [client 131.147.142.132:55642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myairbalance.org"] [uri "/.env"] [unique_id "aXqQX_ZFkjwthIlI8pi_fwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-28 18:40:54 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp) ... show more (mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 13:40:47.023787 2026] [security2:error] [pid 4190061:tid 4190061] [client 131.147.142.132:5162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "candlecrawler.trade"] [uri "/.env"] [unique_id "aXpYL98jm0Y53d9w2gt-_AAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-28 17:32:47 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp) ... show more (mod_security) mod_security (id:210492) triggered by 131.147.142.132 (fp83938e84.tkyc209.ap.nuro.jp): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 12:32:41.147216 2026] [security2:error] [pid 29187:tid 29187] [client 131.147.142.132:50522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "distribuidoradecongeladoscdmx.com"] [uri "/.env"] [unique_id "aXpIORWhzR00fv5qtINW6AAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ambor	2026-01-27 19:27:31 (4 months ago)	Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10 ... show more Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36. Method: GET show less	Web App Attack
🇯🇵 zwh	2025-09-17 18:03:02 (9 months ago)	Attack for XMLRPC	Web App Attack
🇺🇸 xmission.com	2025-09-03 01:00:01 (9 months ago)	Blocked by UFW (TCP on 19385) Source port: 53644 TTL: 116 Packet length: 60 TOS: 0x00 This report ( ... show more Blocked by UFW (TCP on 19385) Source port: 53644 TTL: 116 Packet length: 60 TOS: 0x00 This report (for 131.147.142.132) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2025-07-25 13:39:11 (10 months ago)	Blocked by UFW (TCP on 24136) Source port: 50862 TTL: 116 Packet length: 52 TOS: 0x00 This report ( ... show more Blocked by UFW (TCP on 24136) Source port: 50862 TTL: 116 Packet length: 52 TOS: 0x00 This report (for 131.147.142.132) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇨🇳 ThreatBook.io	2025-07-05 02:39:39 (11 months ago)	ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/131.147.142.132 2 ... show more ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/131.147.142.132 2025-07-04 14:41:51 http://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=4.9.8 show less	Web App Attack
Anonymous	2025-03-09 06:22:17 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇯🇵 zwh	2024-10-06 18:36:32 (1 year ago)	Attack for XMLRPC	Web App Attack
🇯🇵 zwh	2024-10-04 18:38:24 (1 year ago)	Attack for XMLRPC	Web App Attack
🇯🇵 zwh	2024-10-02 18:16:08 (1 year ago)	Attack for XMLRPC	Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇹 151.115.167.48

🇳🇱 91.92.42.86

🇪🇸 46.253.45.10

🇮🇷 46.100.90.90

🇩🇪 216.25.126.4

🇿🇦 196.192.181.202

🇬🇪 188.129.248.135

🇮🇳 175.101.131.169

🇮🇳 106.194.71.89

🇺🇸 52.165.88.92

🇸🇬 43.160.212.102

🇲🇷 41.188.104.16

🇺🇸 167.71.16.88

🇮🇳 117.252.241.201

🇮🇩 117.102.86.226

🇧🇬 78.128.112.30

🇰🇷 61.84.211.107

🇵🇱 54.38.52.18

🇳🇱 45.142.193.18

🇮🇩 36.65.179.96