JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

131.196.5.36

Activity Trending Down

Abuse Confidence Score

8% Caution

20 reports

13 reporters · latest 1 month ago

ISP: GR SOLUCOES TELECOM LTDA - ME
Usage Type: Fixed Line ISP
ASN: AS265890
Domain Name: grsolucoestelecom.com.br
Country: 🇧🇷 Brazil
City: Caruaru, Pernambuco

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

20 from 13 distinct reporters

First reported

November 15th 2025

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇳🇱 Netherlands 1

Most common categories Bad Web Bot 4 Web App Attack 1

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 鬼影233	2026-10-01 21:35:32 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-10-01 14:47:14 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36	Bad Web Bot
🇳🇱 Alt255	2026-10-01 10:38:22 UTC · (1 month ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 131.196.5.36 - - \[01/Oct/2026:12:32:10 +0200\] "GET /node/.env.original HTTP/1.1" 404 2237 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKi ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 131.196.5.36 - - \[01/Oct/2026:12:32:10 +0200\] "GET /node/.env.original HTTP/1.1" 404 2237 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-19 17:03:19 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0	Bad Web Bot
🇺🇸 鬼影233	2026-09-07 20:14:21 UTC · (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0	Bad Web Bot
Anonymous	2026-09-06 22:18:44 UTC · (2 months ago)	Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in email-link.asp	Exploited Host Bad Web Bot
🇺🇸 kosada.com	2026-08-19 02:59:19 UTC · (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-07-31 03:41:59 UTC · (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇷🇸 Scan	2026-07-31 00:34:27 UTC · (3 months ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 RAP	2026-07-30 13:43:24 UTC · (3 months ago)	2026-07-30 13:43:24 UTC Unauthorized activity to TCP port 3306.	Port Scan
Anonymous	2026-07-27 11:11:37 UTC · (3 months ago)	denied traffic to a honeypot network. destination port 31197.	Port Scan Hacking
🇧🇷 opastorello	2026-07-11 04:34:37 UTC · (3 months ago)	Observed participating in a TCP SYN flood / HTTP DDoS attack against one of our servers on port 80/TCP. Traffic profile: SYN 2.2B packets, PSH\|ACK 3.4M packets, ACK 1.07M packets, SYN\|ECE\|CWR 1.5k packets, RST\|ACK 100 packets, FIN\|ACK 100 packets. Mi ... show more Observed participating in a TCP SYN flood / HTTP DDoS attack against one of our servers on port 80/TCP. Traffic profile: SYN 2.2B packets, PSH\|ACK 3.4M packets, ACK 1.07M packets, SYN\|ECE\|CWR 1.5k packets, RST\|ACK 100 packets, FIN\|ACK 100 packets. Mitigation triggered: DDoS Managed Ruleset, 2.11B packets mitigated. Please investigate this host/network for abuse. show less	DDoS Attack
Anonymous	2026-07-01 01:33:00 UTC · (4 months ago)	Port scan on port 443/UDP to unused IP	Port Scan
Anonymous	2026-07-01 00:50:33 UTC · (4 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-01-16 23:45:43 UTC · (9 months ago)	(mod_security) mod_security (id:210730) triggered by 131.196.5.36 (static-131-196-5-36.grsolucoestelecom.com.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 18:45:35.734387 2026] [security2:error] [pid 7611: ... show more (mod_security) mod_security (id:210730) triggered by 131.196.5.36 (static-131-196-5-36.grsolucoestelecom.com.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 18:45:35.734387 2026] [security2:error] [pid 7611:tid 7611] [client 131.196.5.36:57727] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.grupoporvenir.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.grupoporvenir.com"] [uri "/grain-group.com"] [unique_id "aWrNn_ZVHn_U8v37qYuyQQAAAAc"], referer: http://www.grupoporvenir.com/ show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇱 2400:cb00:923:1000:b709:3f7f:32d8:ef26

🇵🇱 2400:cb00:73:1000:8bbf:54d8:d374:efec

🇧🇦 195.222.59.154

🇧🇷 191.52.243.102

🇺🇸 185.77.223.198

🇵🇱 172.64.200.172

🇹🇭 147.50.231.36

🇨🇳 140.246.61.93

🇩🇪 102.220.163.245

🇵🇱 91.228.33.58

🇬🇧 85.120.134.155

🇬🇧 85.28.43.160

🇧🇬 79.124.40.166

🇸🇬 47.82.15.16

🇬🇧 35.203.210.222

🇧🇪 35.195.41.101

🇦🇺 34.151.143.14

🇳🇴 20.251.48.93

🇩🇪 202.61.251.72

🇺🇦 193.37.251.71