JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 189.29.148.106

189.29.148.106

Recent Activity

12 reports found in our database

22% ▲ ▲ ▲ Elevated

Abuse confidence score ?

ISP

Claro NXT Telecomunicacoes Ltda

Usage Type

Fixed Line ISP

ASN

AS28573

Hostname(s)

bd1d946a.virtua.com.br

Domain Name

claro.com.br

Country

🇧🇷 Brazil

City

Santo Andre, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 189.29.148.106:

This IP address has been reported a total of 12 times from 10 distinct sources. 189.29.148.106 was first reported on June 10th 2024, and the most recent report was 6 days ago. In the last 60 days, the top reporter locations were: Germany with 2 reports; France with 1 report; United States of America with 1 report. The most common categories in these recent reports were: Bad Web Bot 2 times; Port Scan 2 times; Brute-Force 2 times; SSH 1 time; Web App Attack 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-15 01:11:32 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 189.29.148.106 (bd1d946a.virtua.com.br): 1 in t ... show more (mod_security) mod_security (id:210492) triggered by 189.29.148.106 (bd1d946a.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 21:11:25.448344 2026] [security2:error] [pid 21618:tid 21618] [client 189.29.148.106:4422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "njoyquilts.sophcomp.com"] [uri "/app/.env.bak~"] [unique_id "aqibPZM8GIcQ7PU96soCOgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 security.rdmc.fr	2026-09-14 18:09:05 (6 days ago)	Port Scan Attack proto:TCP src:20721 dst:23	Port Scan
🇩🇪 klaus_ph	2026-08-10 09:20:00 (1 month ago)	189.29.148.106 - - [09/Aug/2026:02:35:14 +0200] "GET /lka/Record/a0005956/Cite?lng=de HTTP/1.1" 200 ... show more 189.29.148.106 - - [09/Aug/2026:02:35:14 +0200] "GET /lka/Record/a0005956/Cite?lng=de HTTP/1.1" 200 10393 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.160 Safari/537.36" ... show less	Bad Web Bot
Anonymous	2026-07-29 21:20:43 (1 month ago)	denied traffic to a non-approved destination port. destination port 64299.	Port Scan
🇨🇭 vftable	2026-07-23 02:30:16 (1 month ago)	2026-07-23T03:20:33.219681+01:00 naomi sshd[43124]: banner exchange: Connection from 189.29.148.106 ... show more 2026-07-23T03:20:33.219681+01:00 naomi sshd[43124]: banner exchange: Connection from 189.29.148.106 port 2918: invalid format 2026-07-23T03:20:47.616402+01:00 naomi sshd[43084]: banner exchange: Connection from 189.29.148.106 port 29353: invalid format 2026-07-23T03:29:30.439007+01:00 naomi sshd[46893]: banner exchange: Connection from 189.29.148.106 port 2949: invalid format ... show less	Brute-Force SSH
🇦🇺 prologic	2026-06-13 00:13:59 (3 months ago)	Coordinated application-layer DDoS against git.mills.io (self-hosted Gitea), 2026-06-12 ~20:30-21:10 ... show more Coordinated application-layer DDoS against git.mills.io (self-hosted Gitea), 2026-06-12 ~20:30-21:10 UTC. Deliberately expensive multi-label Gitea issue-search queries (/issues?type=all&state=closed&sort=...&labels=<multiple IDs>, ~60-113s CPU each) flooded the backend via proxy/hosting networks. ~36,700 source IPs, ~1 request per IP, identical TLS fingerprint (TLS1.3 0x1301) and one spoofed Chrome UA = single automated tool. show less	DDoS Attack Web App Attack
🇳🇱 trivox.sh	2026-05-14 14:50:15 (4 months ago)	2026-05-14T14:31:34.446580+00:00 ws1.trivox.sh sshd-session[1779796]: banner exchange: Connection fr ... show more 2026-05-14T14:31:34.446580+00:00 ws1.trivox.sh sshd-session[1779796]: banner exchange: Connection from 189.29.148.106 port 29529: invalid format 2026-05-14T14:38:06.644282+00:00 ws1.trivox.sh sshd-session[1794123]: banner exchange: Connection from 189.29.148.106 port 29592: invalid format 2026-05-14T14:38:14.504780+00:00 ws1.trivox.sh sshd-session[1794779]: banner exchange: Connection from 189.29.148.106 port 29313: invalid format 2026-05-14T14:38:37.679026+00:00 ws1.trivox.sh sshd-session[1795763]: banner exchange: Connection from 189.29.148.106 port 15188: invalid format ... show less	Brute-Force SSH
Anonymous	2026-04-29 00:19:57 (4 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 quilla	2026-04-03 03:20:35 (5 months ago)	Botnet infected device observed in honeypot (Vector: TCP)	DDoS Attack
Anonymous	2026-01-06 03:45:00 (8 months ago)	scanning http requests from known botnet	Web App Attack
🇺🇸 TPI-Abuse	2025-10-27 09:42:16 (10 months ago)	(mod_security) mod_security (id:210730) triggered by 189.29.148.106 (bd1d946a.virtua.com.br): 1 in t ... show more (mod_security) mod_security (id:210730) triggered by 189.29.148.106 (bd1d946a.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 27 05:42:08.129662 2025] [security2:error] [pid 32746:tid 32746] [client 189.29.148.106:15994] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|alexetjeremy.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alexetjeremy.com"] [uri "/images/myspace/Thumbs.db"] [unique_id "aP8-cHDTGtXqq9uX9RQXtQAAAAU"], referer: https://alexetjeremy.com/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-06-10 04:13:36 (2 years ago)	Ports: 143,993; Direction: 0; Trigger: LF_DISTATTACK	Brute-Force SSH

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇿 213.211.81.136

🇹🇭 165.154.119.158

🇯🇵 160.251.202.50

🇮🇳 122.187.226.21

🇮🇳 103.192.199.245

🇺🇸 67.145.165.8

🇷🇺 37.29.83.180

🇻🇳 27.118.20.168

🇧🇷 16.5.0.241

🇫🇷 5.189.137.152

🇷🇺 5.102.155.175

🇵🇾 200.85.48.114

🇺🇸 195.184.76.93

🇧🇷 186.208.7.197

🇵🇰 154.57.199.240

🇨🇳 118.145.112.204

🇻🇳 103.118.28.222

🇵🇱 91.231.2.151

🇺🇸 91.230.168.203

🇫🇷 85.217.140.52