JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 191.7.196.128

191.7.196.128 was found in our database!

This IP was reported 121 times. Confidence of Abuse is 19%: ?

19%

ISP	ONLINE TELECOMUNICACOES LTDA
Usage Type	Fixed Line ISP
ASN	AS263327
Hostname(s)	128.196.7.191.online.net.br
Domain Name	onlinetelecom.com.br
Country	🇧🇷 Brazil
City	Granja, Ceara

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 191.7.196.128

Whois 191.7.196.128

IP Abuse Reports for 191.7.196.128:

This IP address has been reported a total of 121 times from 52 distinct sources. 191.7.196.128 was first reported on November 1st 2023, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇴 Fn4ticHz	2026-05-29 02:44:23 (2 weeks ago)	DDoS blocked via ZeroGuard.ID	DDoS Attack Exploited Host
🇫🇷 MatStef132	2026-05-22 14:04:49 (3 weeks ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇳🇱 ByeByte API	2026-05-16 20:03:53 (4 weeks ago)	byebyte.space auth: Rate-limit escalation at 2026-05-16T20:03:52Z: 5 rejections in 300s. Firewall au ... show more byebyte.space auth: Rate-limit escalation at 2026-05-16T20:03:52Z: 5 rejections in 300s. Firewall auto-banned IP for 900s. UA: 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36"'. Accept-Language: 'en-US,en;q=0.9'. Accept-Encoding: 'gzip, br'. Country (CF): BR. TLS info: {"scheme":"https"}. show less	Web App Attack DDoS Attack
🇳🇱 ByeByte API	2026-05-16 18:42:39 (4 weeks ago)	byebyte.space auth: Rate-limit escalation at 2026-05-16T18:42:39Z: 8 rejections in 300s. Firewall au ... show more byebyte.space auth: Rate-limit escalation at 2026-05-16T18:42:39Z: 8 rejections in 300s. Firewall auto-banned IP for 900s. UA: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/17.3'. Accept-Language: 'en,es;q=0.9,zh-CN;q=0.8,zh;q=0.7,pt;q=0.6'. Accept-Encoding: 'gzip, br'. Sec-Ch-Ua: '"Google Chrome";v="128", "Chromium";v="128", "Not.A/Brand";v="24"'. Platform: "Windows" (mobile=?0). Referer: 'https://google.com/'. Country (CF): BR. TLS info: {"scheme":"https"}. show less	Web App Attack DDoS Attack
🇳🇱 ByeByte API	2026-05-16 16:57:13 (4 weeks ago)	byebyte.space auth: Rate-limit escalation at 2026-05-16T16:57:12Z: 8 rejections in 300s. Firewall au ... show more byebyte.space auth: Rate-limit escalation at 2026-05-16T16:57:12Z: 8 rejections in 300s. Firewall auto-banned IP for 900s. UA: 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/17.5'. Accept-Language: 'en,es;q=0.9,zh-CN;q=0.8,zh;q=0.7,pt;q=0.6'. Accept-Encoding: 'gzip, br'. Sec-Ch-Ua: '"Google Chrome";v="121", "Chromium";v="121", "Not.A/Brand";v="24"'. Platform: "Linux" (mobile=?0). Connection: Keep-Alive. Referer: 'https://google.com/'. Country (CF): BR. TLS info: {"scheme":"https"}. show less	Web App Attack DDoS Attack
🇷🇴 Fn4ticHz	2026-05-09 14:14:31 (1 month ago)	Repeated DDoS targeted -- ZeroGuard X ManagedSRV	DDoS Attack Exploited Host
🇮🇹 VHosting	2026-04-26 08:43:11 (1 month ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇮🇹 VHosting	2026-04-10 05:17:16 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇮🇹 IRT@Unisi	2026-03-31 03:48:48 (2 months ago)	anomaly:tcp_dst_session,1001>threshold1000,repeats4182timessincelastlog	DDoS Attack
🇩🇪 grassau.com	2026-03-23 08:11:08 (2 months ago)	(mod_security) mod_security triggered on hostname [redacted] 191.7.196.128 (BR/Brazil/Maranhão/Chapa ... show more (mod_security) mod_security triggered on hostname [redacted] 191.7.196.128 (BR/Brazil/Maranhão/Chapadinha/128.196.7.191.online.net.br) show less	SQL Injection
🇺🇸 COMPLEX	2026-03-17 18:26:52 (2 months ago)	Triggered Cloudflare WAF (l7ddos) from BR. Action taken: MANAGED_CHALLENGE ASN: undefined (undefined ... show more Triggered Cloudflare WAF (l7ddos) from BR. Action taken: MANAGED_CHALLENGE ASN: undefined (undefined) Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0 show less	DDoS Attack Bad Web Bot
🇦🇱 cheatmaster.store	2026-02-27 01:36:47 (3 months ago)	Automated report: This IP address has been identified as an active public open proxy. Classification ... show more Automated report: This IP address has been identified as an active public open proxy. Classification: Open Proxy \| Spoofing \| VPN/Anonymizer \| Bad Web Bot. Country: Brazil Threat level: High. This host is listed across multiple public proxy databases and poses a risk of abuse, credential stuffing, scraping, and spoofed traffic. Reported by automated threat intelligence pipeline. Do not whitelist without manual verification. show less	Web Spam Port Scan Web App Attack
🇳🇱 ConsulHosting	2026-02-15 16:03:42 (3 months ago)	Part of an HTTP Flood DDoS attack and had sent at least 5 requests.	DDoS Attack Exploited Host
🇨🇦 1gz	2025-12-14 21:13:52 (5 months ago)	Triggered Cloudflare WAF (firewallCustom) from BR. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET m ... show more Triggered Cloudflare WAF (firewallCustom) from BR. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /auth/register UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇦🇺 GreyWatch - Honeypot Intelligence	2025-11-09 05:45:16 (7 months ago)	ASN: 263327 (ONLINE TELECOMUNICACOES LTDA) Botnet Zombie: This IP has been detected as a botnet zom ... show more ASN: 263327 (ONLINE TELECOMUNICACOES LTDA) Botnet Zombie: This IP has been detected as a botnet zombie \| Outbound DDoS attack source \| Malicious show less	DDoS Attack Bad Web Bot

Showing 1 to 15 of 121 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇪 91.239.206.123

🇬🇧 35.203.211.160

🇦🇺 34.151.113.98

🇶🇦 2600:1900:4260:40e::24

🇨🇳 218.94.25.243

🇺🇸 205.185.122.174

🇫🇮 178.20.210.208

🇰🇷 175.126.37.156

🇺🇸 147.185.132.58

🇫🇷 91.231.89.66

🇳🇱 91.92.40.46

🇬🇧 89.37.172.144

🇱🇹 45.227.254.170

🇺🇸 35.245.193.196

🇦🇺 34.129.108.223

🇺🇸 2607:f8b0:4001:c62::12d

🇨🇳 223.166.206.215

🇧🇷 200.159.14.187

🇺🇸 193.3.53.10

🇩🇪 185.242.3.111