JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

189.6.7.146

Recent Activity

Abuse Confidence Score

14% Caution

19 reports

14 reporters · latest 2 days ago

ISP: Claro NXT Telecomunicacoes Ltda
Usage Type: Fixed Line ISP
ASN: AS28573
Domain Name: claro.com.br
Country: 🇧🇷 Brazil
City: Brasilia, Federal District

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

19 from 14 distinct reporters

First reported

June 27th 2024

Most recent report

2 days ago

Last 60 days

Top reporter locations 🇮🇩 Indonesia 1 🇺🇸 United States of America 1

Most common categories Hacking 1 Email Spam 1 Bad Web Bot 1 Brute-Force 1 Web App Attack 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 hermawan	2026-11-12 06:49:17 UTC · (2 days ago)	[Thu Nov 12 13:49:17.209052 2026] [security2:error] [pid 651613:tid 139652841322176] [client 189.6.7.146:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/mods ... show more [Thu Nov 12 13:49:17.209052 2026] [security2:error] [pid 651613:tid 139652841322176] [client 189.6.7.146:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "214"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=476&id=819%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-1-7-desember-2015&start=100 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=476&id=819%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-1-7-desember-2015&start=10..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "avVhbaNKQ8-QGe ... show less	Email Spam Hacking
🇺🇸 TPI-Abuse	2026-10-27 02:35:21 UTC · (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 189.6.7.146 (bd060792.virtua.com.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 22:35:15.993082 2026] [security2:error] [pid 19828:tid 19857] [client 189 ... show more (mod_security) mod_security (id:210350) triggered by 189.6.7.146 (bd060792.virtua.com.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 22:35:15.993082 2026] [security2:error] [pid 19828:tid 19857] [client 189.6.7.146:44577] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|dermatologistcoloradosprings.com\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dermatologistcoloradosprings.com"] [uri "/"] [unique_id "auAN43cM327HgTcTGTLxLAAAAJQ"], referer: https://pueblodermatology.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 ✨	2025-03-25 21:56:04 UTC · (1 year ago)	Rule : SMTP BOT 03/25/25 21:42:43 1872 189.6.7.146 *hidden-privacy* ESMTP MAIL Service ready at 03/25/25 21:42:43 75 0 03/25/25 21:42:43 1872 189.6.7.146 EHLO EHLO bd060792.virtua.com.br 550 Policy violation. Connection refused. 118 29	Email Spam Port Scan Spoofing Brute-Force
Anonymous	2025-03-25 15:11:14 UTC · (1 year ago)	spam	Email Spam
🇪🇸 librebit	2025-03-24 10:30:18 UTC · (1 year ago)	Postfix: Illegal address from unknown sender	Spoofing
Anonymous	2025-03-19 16:17:00 UTC · (1 year ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇳🇱 Mangelot Hosting	2025-01-22 07:41:00 UTC · (1 year ago)	(RCPT) RCPT NOT ALLOWED FROM 189.6.7.146 (BR/Brazil/bd060792.virtua.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:	Web App Attack
🇵🇹 rnl	2025-01-15 00:24:03 UTC · (1 year ago)	postfix	Email Spam Brute-Force
🇦🇷 OcampoFer	2024-10-02 05:12:46 UTC · (2 years ago)	SPAM - IP blocked by DNSBL for a period of 12 hours.	Email Spam
🇵🇹 rnl	2024-09-26 07:39:01 UTC · (2 years ago)	postfix (unknown user, SPF fail or relay access denied)	Brute-Force
🇺🇸 vestibtech	2024-09-21 11:37:23 UTC · (2 years ago)	Sep 21 05:37:23 Host-KLAX-C postfix/in_clean/cleanup[494107]: CE9BD1BCD9A: reject: header Subject: Your personal data has leaked due to suspected harmful activities. from unknown[189.6.7.146]; from=<[email protected]> to=<[email protected] ... show more Sep 21 05:37:23 Host-KLAX-C postfix/in_clean/cleanup[494107]: CE9BD1BCD9A: reject: header Subject: Your personal data has leaked due to suspected harmful activities. from unknown[189.6.7.146]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<bd060792.virtua.com.br>: 5.7.1 Message identified as SPAM - Rule #527 ... show less	Email Spam
🇺🇸 DiodeDave	2024-08-15 20:35:16 UTC · (2 years ago)	Multiple sign in attempts from blocked location	Hacking
🇺🇸 DiodeDave	2024-08-14 17:01:08 UTC · (2 years ago)	Multiple sign in attempts from blocked location	Hacking
🇬🇧 Hobby Bob	2024-08-12 18:44:07 UTC · (2 years ago)	Aug 12 19:44:07 mail postfix/smtpd[1491792]: NOQUEUE: reject: RCPT from unknown[189.6.7.146]: 554 5.7.1 Service unavailable; Client host [189.6.7.146] blocked using zen.spamhaus.org; Listed by CSS, see https://check.spamhaus.org/query/ip/189.6.7.146 ... show more Aug 12 19:44:07 mail postfix/smtpd[1491792]: NOQUEUE: reject: RCPT from unknown[189.6.7.146]: 554 5.7.1 Service unavailable; Client host [189.6.7.146] blocked using zen.spamhaus.org; Listed by CSS, see https://check.spamhaus.org/query/ip/189.6.7.146 / Listed by PBL, see https://check.spamhaus.org/query/ip/189.6.7.146 / Listed by XBL, see https://check.spamhaus.org/query/ip/189.6.7.146; from= to= proto=ESMTP helo= show less	Email Spam
🇳🇱 vestibtech	2024-07-31 17:19:46 UTC · (2 years ago)	Jul 31 11:19:45 Host-KLAX-C postfix/in_clean/cleanup[215622]: 3F8F31BD01B: reject: header Subject: Your personal data has leaked due to suspected harmful activities. from unknown[189.6.7.146]; from=<[email protected]> to=<[email protected]> p ... show more Jul 31 11:19:45 Host-KLAX-C postfix/in_clean/cleanup[215622]: 3F8F31BD01B: reject: header Subject: Your personal data has leaked due to suspected harmful activities. from unknown[189.6.7.146]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<bd060792.virtua.com.br>: 5.7.1 Message identified as SPAM - Rule #527 ... show less	Email Spam

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇩 103.24.212.42

🇮🇳 103.8.118.145

🇳🇱 89.21.67.173

🇨🇦 45.198.224.94

🇺🇸 31.134.9.226

🇺🇸 20.80.98.118

🇺🇸 213.219.254.25

🇨🇴 201.184.50.251

🇺🇸 192.190.221.7

🇳🇱 185.223.235.29

🇷🇺 178.177.196.209

🇸🇳 172.226.148.144

🇰🇷 112.161.26.125

🇬🇧 81.19.219.221

🇭🇺 5.204.90.181

🇺🇸 185.226.196.24

🇺🇸 134.33.96.248

🇨🇳 120.48.175.69

🇳🇱 64.205.72.136

🇵🇭 45.195.15.229