JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 191.10.130.40

191.10.130.40 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 99%: ?

99%

ISP	TELEFÔNICA BRASIL S.A
Usage Type	Fixed Line ISP
ASN	AS26599
Hostname(s)	191-10-130-40.user.vivozap.com.br
Domain Name	telefonica.com.br
Country	🇧🇷 Brazil
City	Recife, Pernambuco

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 191.10.130.40

Whois 191.10.130.40

IP Abuse Reports for 191.10.130.40:

This IP address has been reported a total of 23 times from 18 distinct sources. 191.10.130.40 was first reported on August 17th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-08-23 22:19:51 (8 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-08-23 19:58:02 (10 hours ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇫🇷 ELYAZ	2026-08-23 14:46:25 (16 hours ago)	(wordpress) Failed wordpress login from 191.10.130.40 (BR/Brazil/191-10-130-40.user.vivozap.com.br): ... show more (wordpress) Failed wordpress login from 191.10.130.40 (BR/Brazil/191-10-130-40.user.vivozap.com.br): (CF_ENABLE) show less	Brute-Force
Anonymous	2026-08-23 14:32:26 (16 hours ago)	(wordpress) Failed wordpress login from 191.10.130.40 (BR/Brazil/191-10-130-40.user.vivozap.com.br)	Brute-Force
🇩🇪 4server	2026-08-22 18:54:20 (1 day ago)	[SatAug2220:54:15.8592802026][security2:error][pid2830866:tid2830969][client191.10.130.40:0]ModSecur ... show more [SatAug2220:54:15.8592802026][security2:error][pid2830866:tid2830969][client191.10.130.40:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"domoticaswiss.ch\"][uri\"/xmlrpc.php\"][unique_id\"aonwV1UVdxqj7Dh1j0S0pQAAAg4\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-08-22 18:42:20 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 inlink.ltd	2026-08-22 12:40:12 (1 day ago)	Known malicious PHP file or CMS probe	Web App Attack
🇩🇪 stinpriza	2026-08-22 10:19:44 (1 day ago)	Web App Attack	Web App Attack
Anonymous	2026-08-21 21:54:43 (2 days ago)	[redacted] 191.10.130.40 - - [21/Aug/2026:23:53:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "M ... show more [redacted] 191.10.130.40 - - [21/Aug/2026:23:53:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/81.0.0.0 Safari/537.36" [redacted] 191.10.130.40 - - [21/Aug/2026:23:53:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/82.0.0.0 Safari/537.36" [redacted] 191.10.130.40 - - [21/Aug/2026:23:53:56 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/61.0.0.0 Safari/537.36" [redacted] 191.10.130.40 - - [21/Aug/2026:23:53:57 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/74.0.0.0 Safari/537.36" [redacted] 191.10.130.40 - - [21/Aug/2026:23:54:16 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; ... show less	Hacking Web App Attack
🇫🇮 paissangroup	2026-08-21 13:03:04 (2 days ago)	Multiple WAF Violations	Web App Attack
🇮🇹 LTM	2026-08-21 06:20:01 (3 days ago)	WebServer - Attempts to exploit	Hacking Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-08-20 23:47:34 (3 days ago)	Try to access /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 23:19:17 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 191.10.130.40 (191-10-130-40.user.vivozap.com.b ... show more (mod_security) mod_security (id:225170) triggered by 191.10.130.40 (191-10-130-40.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 19:19:10.650143 2026] [security2:error] [pid 25570:tid 25570] [client 191.10.130.40:58103] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|doreenkimura.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "doreenkimura.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoeLbsba3IAf6dCse-SE9gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-20 07:50:43 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 191.10.130.40 (191-10-130-40.user.vivozap.com.b ... show more (mod_security) mod_security (id:225170) triggered by 191.10.130.40 (191-10-130-40.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 03:50:38.434866 2026] [security2:error] [pid 11072:tid 11072] [client 191.10.130.40:63888] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jdeloa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jdeloa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoaxzrzTaRuQGTh_Oq0gkQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-19 23:40:19 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 191.10.130.40 (191-10-130-40.user.vivozap.com.b ... show more (mod_security) mod_security (id:225170) triggered by 191.10.130.40 (191-10-130-40.user.vivozap.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 19 19:40:15.185330 2026] [security2:error] [pid 5466:tid 5466] [client 191.10.130.40:58315] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|anamericanabroad.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "anamericanabroad.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aoY-395J8XRVuu7IP0pvYAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 46.245.15.255

🇶🇦 2a0d:3344:4782:d808:2dbc:7a0a:8dcc:ae67

🇺🇸 199.96.166.85

🇺🇸 184.105.139.69

🇧🇷 177.87.117.10

🇺🇸 172.98.189.11

🇨🇳 171.83.85.0

🇫🇮 147.185.133.116

🇺🇸 143.198.73.97

🇭🇰 121.202.213.247

🇺🇦 91.224.44.53

🇫🇷 85.217.140.3

🇳🇱 81.19.216.125

🇩🇪 69.5.169.251

🇺🇸 45.79.225.32

🇬🇧 35.203.211.40

🇺🇸 2001:470:1:332::27

🇧🇷 177.129.145.183

🇺🇸 173.254.211.184

🇸🇪 171.25.158.87