JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 164.152.27.235

164.152.27.235 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 88%: ?

88%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 164.152.27.235

Whois 164.152.27.235

IP Abuse Reports for 164.152.27.235:

This IP address has been reported a total of 17 times from 17 distinct sources. 164.152.27.235 was first reported on October 13th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-16 20:30:04 (2 hours ago)	SIEM ALERT AUTO REPORT	Email Spam
🇨🇭 Elysium Security	2026-10-16 20:17:16 (3 hours ago)	Mass port scanning on a whole network	Port Scan
🇫🇷 agroman93	2026-10-16 20:11:49 (3 hours ago)	T-Pot honeypot: 1127 hits on ports [8545] (automated)	Port Scan
🇩🇪 phil2k	2026-10-16 03:50:19 (19 hours ago)	fail2ban:firewall:2026-10-16T05:50:07.232475+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> ... show more fail2ban:firewall:2026-10-16T05:50:07.232475+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=164.152.27.235 DST=<ANONYMIZED_IP> LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=TCP SPT=10475 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0 2026-10-16T05:50:15.847275+02:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=164.152.27.235 DST=<ANONYMIZED_IP> LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=TCP SPT=10941 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0 show less	DDoS Attack Port Scan Brute-Force SSH
🇬🇧 [email protected]	2026-10-16 03:27:06 (19 hours ago)	Automated report [Server: quest1]: IP caught scanning and attacking Aison Active Defense Honeypot tr ... show more Automated report [Server: quest1]: IP caught scanning and attacking Aison Active Defense Honeypot traps. show less	Port Scan Hacking Brute-Force
🇬🇧 blik2108	2026-10-15 20:27:46 (1 day ago)	beta.sleepylizard.com:80 164.152.27.235 - - [15/Oct/2026:21:27:42 +0100] "GET /config/digitalocean.j ... show more beta.sleepylizard.com:80 164.152.27.235 - - [15/Oct/2026:21:27:42 +0100] "GET /config/digitalocean.json HTTP/1.1" 301 615 "-" "WebSiphon/next-0.1" beta.sleepylizard.com:80 164.152.27.235 - - [15/Oct/2026:21:27:42 +0100] "GET /config/.env HTTP/1.1" 301 589 "-" "WebSiphon/next-0.1" beta.sleepylizard.com:80 164.152.27.235 - - [15/Oct/2026:21:27:43 +0100] "GET /config.yaml HTTP/1.1" 301 589 "-" "WebSiphon/next-0.1" beta.sleepylizard.com:80 164.152.27.235 - - [15/Oct/2026:21:27:43 +0100] "GET /config.json HTTP/1.1" 301 589 "-" "WebSiphon/next-0.1" beta.sleepylizard.com:80 164.152.27.235 - - [15/Oct/2026:21:27:43 +0100] "GET /config.yml HTTP/1.1" 301 587 "-" "WebSiphon/next-0.1" ... show less	Brute-Force
Anonymous	2026-10-15 05:48:13 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇨🇱 ifiguero	2026-10-15 04:51:43 (1 day ago)	Web Attack (\x00\x00\x00\x00\x00). 7d ban	Web App Attack
🇺🇸 JL41414141	2026-10-15 04:45:44 (1 day ago)	164.152.27.235 - - [15/Oct/2026:04:45:44 +0000] "GET /terraform/terraform.tfstate.backup HTTP/1.1" 4 ... show more 164.152.27.235 - - [15/Oct/2026:04:45:44 +0000] "GET /terraform/terraform.tfstate.backup HTTP/1.1" 404 118 "-" "WebSiphon/next-0.1" 164.152.27.235 - - [15/Oct/2026:04:45:44 +0000] "GET /terraform/terraform.tfvars.json HTTP/1.1" 404 118 "-" "WebSiphon/next-0.1" ... show less	Web Spam
🇯🇵 amyriad	2026-10-15 00:05:54 (1 day ago)	164.152.27.235 - - [15/Oct/2026:09:05:49 +0900] "GET /.oci/config.backup HTTP/1.1" 404 4402 "-" "Web ... show more 164.152.27.235 - - [15/Oct/2026:09:05:49 +0900] "GET /.oci/config.backup HTTP/1.1" 404 4402 "-" "WebSiphon/next-0.1" 164.152.27.235 - - [15/Oct/2026:09:05:49 +0900] "GET /terraform.tfstate.backup HTTP/1.1" 404 459 "-" "WebSiphon/next-0.1" 164.152.27.235 - - [15/Oct/2026:09:05:53 +0900] "GET /.env.bak HTTP/1.1" 404 459 "-" "WebSiphon/next-0.1" ... show less	DDoS Attack Hacking Brute-Force
🇩🇪 Ilop	2026-10-14 21:00:05 (2 days ago)	[hp-100] 801 unsolicited packets to honeypot ports 80,5555 (OCI DShield sensor)	Port Scan
🇬🇧 rooster	2026-10-14 19:59:00 (2 days ago)	[14/Oct/2026:20:58:59 +0100] 404 - GET http 141.147.73.25 "/oci_config.yaml" [Client 164.152.27.235] ... show more [14/Oct/2026:20:58:59 +0100] 404 - GET http 141.147.73.25 "/oci_config.yaml" [Client 164.152.27.235] [Length 122] [Gzip 1.35] "WebSiphon/next-0.1" "-" [14/Oct/2026:20:58:59 +0100] 404 - GET http 141.147.73.25 "/infrastructure/terraform.tfstate" [Client 164.152.27.235] [Length 122] [Gzip 1.35] "WebSiphon/next-0.1" "-" [14/Oct/2026:20:58:59 +0100] 404 - GET http 141.147.73.25 "/providers.tf" [Client 164.152.27.235] [Length 122] [Gzip 1.35] "WebSiphon/next-0.1" "-" [14/Oct/2026:20:58:59 +0100] 404 - GET http 141.147.73.25 "/.oci/config.bak" [Client 164.152.27.235] [Length 122] [Gzip 1.35] "WebSiphon/next-0.1" "-" [14/Oct/2026:20:58:59 +0100] 404 - GET http 141.147.73.25 "/.oci/config.backup" [Client 164.152.27.235] [Length 122] [Gzip 1.35] "WebSiphon/next-0.1" "-" ... show less	Hacking Web App Attack
🇩🇪 Kitki30.com	2026-10-14 13:11:29 (2 days ago)	HTTP Probing (server 3). Log: 164.152.27.235 - - [14/Oct/2026:13:11:28 +0000] "GET /Dockerrun.aws.js ... show more HTTP Probing (server 3). Log: 164.152.27.235 - - [14/Oct/2026:13:11:28 +0000] "GET /Dockerrun.aws.json HTTP/1.1" 301 162 "-" "WebSiphon/next-0.1" 164.152.27.235 - - [14/Oct/2026:13:11:28 +0000] "GET /.gitlab-ci.yml HTTP/1.1" 301 162 "-" "WebSiphon/next-0.1" show less	Brute-Force Bad Web Bot Web App Attack
🇨🇱 ovallevelasquezanibal	2026-10-14 12:00:17 (2 days ago)	Detectado por Wazuh SIEM en api-ux.com \| Alertas: 369 \| Nivel max: 10 \| Agentes: web-apiux-2025 \| Mu ... show more Detectado por Wazuh SIEM en api-ux.com \| Alertas: 369 \| Nivel max: 10 \| Agentes: web-apiux-2025 \| Multiple web server 400 error codes from same source ip.; Web server 400 error code.; Suspicious URL access. show less	Web App Attack
Anonymous	2026-10-13 22:09:17 (3 days ago)	Web scanning: repeated requests for files and exploit paths this site does not serve (.env, .git, ph ... show more Web scanning: repeated requests for files and exploit paths this site does not serve (.env, .git, phpunit, cgi-bin). Reported by fail2ban. show less	Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇱 147.235.219.254

🇺🇸 66.132.224.33

🇰🇷 220.76.220.247

🇨🇳 120.48.175.69

🇰🇿 77.245.111.212

🇳🇱 34.34.122.97

🇺🇸 20.163.3.47

🇦🇹 15.158.192.73

🇺🇸 9.234.42.210

🇯🇵 2602:f71d:400::10

🇨🇳 202.100.41.30

🇩🇪 172.71.172.105

🇧🇬 79.124.49.90

🇧🇪 34.52.133.111

🇺🇸 147.185.132.13

🇬🇧 178.62.108.86

🇮🇳 122.165.56.162

🇫🇷 85.217.140.50

🇺🇸 70.166.131.111

🇺🇸 50.2.99.53