189.112.137.21
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- ALGAR TELECOM S/A
- Usage Type
- Fixed Line ISP
- ASN
- AS16735
- Domain Name
- algar.com.br
- Country
- 🇧🇷 Brazil
- City
- Santos, Sao Paulo
Abuse Reports
Total reports
19 from
19 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇩🇪 zobber |
Dropped suspicious scanning traffic targeting ports: TCP/8443 TCP/1443 on perimeter firewall.
|
Port Scan | |
| 🇸🇰 GOVCERT |
Excessive Firewall Denies
|
DDoS Attack Web Spam | |
| Anonymous |
Reported from Nginx log analysis 19. Log: 189.112.137.21 - - [06/Nov/2026:xx:xx:xx 0100] "GET / HTTP/1.0" xxx xxx "-" "Mozilla/5.0" "-" "BR Brazil S\xC3\xA3o Paulo" "AS16735" "ALGAR TELECOM S/A"
|
Port Scan Brute-Force SSH | |
| 🇩🇪 MarcoH |
Port scan automatically detected by Fail2Ban
|
Port Scan | |
| 🇫🇷 uthul |
T-Pot honeypot: 187 hits on ports [80, 443, 1200, 1443, 2080, 4369, 5029, 5038, 5060, 5080] (automated)
|
Port Scan Hacking Web App Attack | |
| 🇵🇱 Kolobrzeg |
Repeated protocol probing of VNC relay service port (unknown commands, silent or malformed connections), blocked after repeated attempts. Last seen 2026-11-02 17:55 UTC. Automated detection. AS16735 ALGAR TELECOM S/A.
|
Port Scan | |
| 🇩🇪 wiredalter |
Blocked by UFW on dVPS [8667/tcp]
Source Port: 39689
TTL: 45
Packet Length: 60
TOS: 0x00
Analyzed by https://ip.wiredalter.com
|
Port Scan Brute-Force | |
| 🇩🇪 iRaphi05 |
Honeypot detection: GET request on /vicidial/project_auth_entries.txt | User-Agent: Mozilla/5.0
|
Hacking Web App Attack | |
| 🇷🇺 weke |
|
Port Scan | |
| 🇧🇪 delabiemedia.be |
|
Web App Attack | |
| Anonymous |
fail2ban: Sensitive web probes detected
|
Web App Attack | |
| 🇺🇸 sistemacapital |
HTTP: repeated requests for unsupported script paths.
|
Web App Attack | |
| 🇺🇸 legionMCCXV |
PHP/WordPress shell scanner on non-PHP site — repeated requests to .php paths returning 404.
|
Bad Web Bot | |
| 🇺🇸 IndigoRidge |
Knock-Knock HTTP honeypot activity; time=2026-10-28 19:02:32; http_method=GET; http_path=/; http_purpose=basic_probe; http_user_agent=Mozilla/5.0
|
Web App Attack | |
| 🇩🇪 Jochen Pretli |
connection to honeypot
|
Email Spam Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown