JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 189.1.191.27

189.1.191.27 was found in our database!

This IP was reported 4 times. Confidence of Abuse is 23%: ?

23%

ISP	VERO S.A
Usage Type	Fixed Line ISP
ASN	AS28667
Hostname(s)	27.191.1.189.in-addr.arpa.verointernet.com.br
Domain Name	querovero.com.br
Country	🇧🇷 Brazil
City	Limeira, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 189.1.191.27

Whois 189.1.191.27

IP Abuse Reports for 189.1.191.27:

This IP address has been reported a total of 4 times from 4 distinct sources. 189.1.191.27 was first reported on March 28th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-15 19:02:40 (1 day ago)	(mod_security) mod_security (id:210350) triggered by 189.1.191.27 (27.191.1.189.in-addr.arpa.veroint ... show more (mod_security) mod_security (id:210350) triggered by 189.1.191.27 (27.191.1.189.in-addr.arpa.verointernet.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 15:02:33.888755 2026] [security2:error] [pid 25303:tid 25303] [client 189.1.191.27:32049] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|antiradares.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "antiradares.net"] [uri "/"] [unique_id "aqmWSeVuFdgomJgj9Bmy0gAAABg"], referer: https://conductornovel.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-09-10 06:03:13 (6 days ago)	Repeated requests classified as pathological web bot behavior, for example: /search?f%5B0%5D=key_ter ... show more Repeated requests classified as pathological web bot behavior, for example: /search?f%5B0%5D=key_terms%3A311&f%5B10%5D=key_terms%3A524&f%5B11%5D=key_terms%3A530&f%5B12%5D=key_terms%3A543&f%5B1%5D=key_terms%3A312&f%5B2%5D=key_terms%3A316&f%5B3%5D=key_terms%3A329&f%5B4%5D=key_terms%3A355&f%5B5%5D=key_terms%3A383&f%5B6%5D=key_terms%3A389&f%5B7%5D=key_terms%3A517&f%5B8%5D=key_terms%3A519&f%5B9%5D=key_terms%3A522 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0") show less	DDoS Attack Bad Web Bot
🇺🇸 gui-ying233	2026-09-05 10:00:56 (1 week ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 quilla	2026-03-28 23:35:00 (5 months ago)	Botnet infected device observed in honeypot (Vector: TCP HANDSHAKE ATTACK)	DDoS Attack

Showing 1 to 4 of 4 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 218.64.60.114

🇳🇱 192.253.248.173

🇺🇸 185.210.43.161

🇧🇷 179.42.7.72

🇻🇳 171.244.5.213

🇩🇰 103.204.121.222

🇵🇹 103.73.155.214

🇺🇦 91.241.101.91

🇹🇷 78.135.111.62

🇺🇸 24.234.205.105

🇺🇸 216.25.89.87

🇳🇱 195.178.110.108

🇬🇧 194.50.235.142

🇺🇸 185.188.77.36

🇧🇷 181.191.130.229

🇺🇸 173.254.208.28

🇺🇸 154.17.141.181

🇹🇭 118.173.48.88

🇫🇷 91.231.89.58

🇺🇸 72.211.58.151