JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 131.196.85.254

131.196.85.254 was found in our database!

This IP was reported 129 times. Confidence of Abuse is 88%: ?

88%

ISP	DAL MORA & CIA LTDA - EPP
Usage Type	Fixed Line ISP
ASN	AS265907
Domain Name	dalmora.com.br
Country	🇧🇷 Brazil
City	Nova Mutum, Mato Grosso

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 131.196.85.254

Whois 131.196.85.254

IP Abuse Reports for 131.196.85.254:

This IP address has been reported a total of 129 times from 69 distinct sources. 131.196.85.254 was first reported on December 30th 2025, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 smtp.com.es	2026-07-23 17:42:22 (20 hours ago)	Brute force attempt.	Brute-Force Email Spam
🇩🇪 FeG Deutschland	2026-07-19 07:16:03 (5 days ago)	Mail: - login with unknown user - bruteforce	Brute-Force
🇺🇸 vestibtech	2026-07-15 09:09:21 (1 week ago)	2026-07-15T03:09:20.479064-06:00 Host-KLAX-C dovecot[1982391]: imap-login: Disconnected: Connection ... show more 2026-07-15T03:09:20.479064-06:00 Host-KLAX-C dovecot[1982391]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<guido.info>, method=PLAIN, rip=131.196.85.254, lip=185.198.26.44, TLS, session=<4WLSrKJW+MGDxFX+> ... show less	Brute-Force
🇩🇪 netclix.gr	2026-07-14 21:10:39 (1 week ago)	(imapd) Failed IMAP login from 131.196.85.254 (BR/Brazil/-)	Brute-Force
🇮🇩 sockominfo	2026-07-12 18:00:52 (1 week ago)	Zimbra: Login failures from malicious IP: 131.196.85.254. Threat Score: 6.3/10 (MEDIUM). Confidence: ... show more Zimbra: Login failures from malicious IP: 131.196.85.254. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-07-12 17:00:13 (1 week ago)	Zimbra: Login failures from malicious IP: 131.196.85.254. Threat Score: 6/10 (MEDIUM). Reported by T ... show more Zimbra: Login failures from malicious IP: 131.196.85.254. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇬🇧 adnscom.net	2026-07-11 19:46:08 (1 week ago)	IPS trigger: IMAP scanning/attack	Brute-Force Port Scan Hacking
🇮🇳 dineshskt4all	2026-07-11 19:12:30 (1 week ago)	Jul 11 19:12:19 auth: Info: passwd-file([email protected],131.196.85.254,<ltbbolpWQ5ODxFX+>): unkno ... show more Jul 11 19:12:19 auth: Info: passwd-file([email protected],131.196.85.254,<ltbbolpWQ5ODxFX+>): unknown user Jul 11 19:12:21 imap-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<[email protected]>, method=PLAIN, rip=131.196.85.254, lip=68.183.87.236, TLS, session=<ltbbolpWQ5ODxFX+> ... show less	SSH
🇷🇸 Smel	2026-07-11 11:04:02 (1 week ago)	Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -	Email Spam Hacking Brute-Force
🇦🇹 joe-abuse	2026-07-11 01:37:59 (1 week ago)	Automated report from fail2ban on mail.fitzgerald.eu. Jail: dovecot. First seen: 2026-07-09 03:30:42 ... show more Automated report from fail2ban on mail.fitzgerald.eu. Jail: dovecot. First seen: 2026-07-09 03:30:42. Events: 21. Reported by ipdb-security/fitzgerald.eu show less	Brute-Force
🇸🇰 Schomburg	2026-07-09 05:56:35 (2 weeks ago)	RdpGuard detected brute-force attempt on POP3	Brute-Force
Anonymous	2026-07-08 11:48:23 (2 weeks ago)	2026-07-08 11:48:23 warning[1787561]: host [131.196.85.254]: unauthorized access attempted ... show more 2026-07-08 11:48:23 warning[1787561]: host [131.196.85.254]: unauthorized access attempted: / show less	Port Scan Brute-Force
🇫🇮 danskefilm.dk	2026-07-07 22:40:01 (2 weeks ago)	IMAP password guessing	Brute-Force
🇦🇹 joe-abuse	2026-07-07 21:56:18 (2 weeks ago)	2026-07-07T23:56:17.171393+02:00 ucs1 dovecot: auth: pam([email protected],131.196.85.254,<VlbbdQ ... show more 2026-07-07T23:56:17.171393+02:00 ucs1 dovecot: auth: pam([email protected],131.196.85.254,<VlbbdQxWeJuDxFX+>): unknown user (given password: Nom2017) ... show less	Brute-Force
🇫🇷 iroco.co	2026-07-07 07:18:03 (2 weeks ago)	Jul 7 09:18:03 iroco cyrus/imap[694415]: badlogin: [131.196.85.254] PLAIN ([email protected]) [ ... show more Jul 7 09:18:03 iroco cyrus/imap[694415]: badlogin: [131.196.85.254] PLAIN ([email protected]) [SASL(-13): authentication failure: Password verification failed] ... show less	Email Spam

Showing 1 to 15 of 129 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇰 154.14.31.10

🇩🇪 104.28.159.2

🇩🇿 41.111.179.26

🇩🇪 38.246.32.70

🇦🇿 31.171.49.9

🇺🇸 13.89.124.216

🇨🇳 175.165.83.169

🇺🇸 143.244.160.146

🇨🇳 123.96.195.249

🇰🇷 61.84.211.107

🇬🇧 45.82.76.100

🇲🇽 45.7.66.57

🇬🇧 35.203.211.74

🇨🇦 4.204.201.85

🇩🇪 185.220.70.83

🇨🇳 106.114.108.208

🇺🇸 104.17.153.222

🇺🇸 103.234.62.27

🇮🇳 47.15.237.55

🇶🇦 34.153.64.216