JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

177.245.225.100

Recent Activity

Abuse Confidence Score

36% Elevated

16 reports

7 reporters · latest 4 days ago

ISP: Mega Cable, S.A. de C.V.
Usage Type: Fixed Line ISP
ASN: AS13999
Hostname(s): customer-leon-cgn-225-100.megared.net.mx
Domain Name: mega.mx
Country: 🇲🇽 Mexico
City: Leon de los Aldama, Guanajuato

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

16 from 7 distinct reporters

First reported

August 15th 2026

Most recent report

4 days ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 10 🇫🇷 France 1 🇭🇺 Hungary 1

Most common categories Bad Web Bot 11 Web App Attack 3 Brute-Force 2 Hacking 2 Exploited Host 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 bcsaba	2026-11-09 23:55:46 UTC · (4 days ago)	BadBot/Botnet member (ignoring robots.txt...) 177.245.225.100 - - [10/Nov/2026:00:55:44 +0100] "GET /attachments/article/1942/Dr.%20Dukai%20M.%202024.08.28.%20al%C4%82%C4%84%C4%82%C2%ADrt%2015%20%C4%82%C5%82ra%2042%20%C4%82%C5%82ra.pdf HTTP/1.1" 404 ... show more BadBot/Botnet member (ignoring robots.txt...) 177.245.225.100 - - [10/Nov/2026:00:55:44 +0100] "GET /attachments/article/1942/Dr.%20Dukai%20M.%202024.08.28.%20al%C4%82%C4%84%C4%82%C2%ADrt%2015%20%C4%82%C5%82ra%2042%20%C4%82%C5%82ra.pdf HTTP/1.1" 404 1517 "-" "msh-pdfmin/1" show less	Bad Web Bot Exploited Host Web App Attack
🇺🇸 justbible	2026-11-09 19:54:25 UTC · (4 days ago)	HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 22 requests from 2026-11-09T19:54:25+00:00 to 2026-11-11T03:13:26+00:00, e.g. 'GET /en/kjv,bbe/ps/141/9 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) A ... show more HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 22 requests from 2026-11-09T19:54:25+00:00 to 2026-11-11T03:13:26+00:00, e.g. 'GET /en/kjv,bbe/ps/141/9 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested). show less	Bad Web Bot
Anonymous	2026-11-08 14:15:03 UTC · (5 days ago)	Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group \| Blocked by User-Agent Filter (Bad Bot Pattern: MSIE 6.): Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/4.1) \| UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows CE; Trident/4.1) \| (Magento Site) show less	Hacking Bad Web Bot
🇫🇷 Sklurk	2026-11-08 01:52:51 UTC · (6 days ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-10-23 09:48:11 UTC · (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 177.245.225.100 (customer-LEON-CGN-225-100.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 05:48:03.860538 2026] [security2:error] [pid 7146:t ... show more (mod_security) mod_security (id:210350) triggered by 177.245.225.100 (customer-LEON-CGN-225-100.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 05:48:03.860538 2026] [security2:error] [pid 7146:tid 7146] [client 177.245.225.100:12845] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|roguetechhub.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "roguetechhub.com"] [uri "/soggy-monthly-meeting-march-2018"] [unique_id "atstUyL5Mmb_JM78eP_5LwAAAAU"], referer: https://savagefarmer.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 dealpickeal	2026-10-22 16:53:53 UTC · (3 weeks ago)	Unauthorized authentication attempt against our Microsoft Entra ID tenant. Source IP: 177.245.225.100 Application: Microsoft Azure CLI Event time (UTC): 46315.74211 Error code: 50053 Result: The account is locked, you've tried to sign in too m ... show more Unauthorized authentication attempt against our Microsoft Entra ID tenant. Source IP: 177.245.225.100 Application: Microsoft Azure CLI Event time (UTC): 46315.74211 Error code: 50053 Result: The account is locked, you've tried to sign in too many times with an incorrect user ID or password. Destination service: login.microsoftonline.com Destination port: TCP 443 Activity is consistent with automated password spraying, credential stuffing, or brute-force authentication attempts. show less	Brute-Force Hacking
🇺🇸 鬼影233	2026-10-15 05:14:09 UTC · (4 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-10-01 20:51:17 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-10-01 11:12:36 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-10-01 06:49:40 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-30 11:55:48 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 08:29:00 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-22 10:37:06 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-11 19:39:18 UTC · (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-05 20:06:34 UTC · (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36	Bad Web Bot

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2602:80d:1008::47

🇺🇸 195.184.76.112

🇯🇵 139.162.116.22

🇺🇸 109.105.210.62

🇺🇸 71.6.147.254

🇺🇸 66.132.195.24

🇺🇸 66.132.186.190

🇺🇸 23.254.232.227

🇰🇷 220.80.232.146

🇧🇷 200.103.189.171

🇺🇸 195.184.76.185

🇬🇧 185.7.214.240

🇨🇳 171.39.113.209

🇺🇸 162.216.149.235

🇺🇸 162.216.149.97

🇺🇸 147.185.132.219

🇨🇳 139.170.72.245

🇮🇳 120.56.14.179

🇹🇷 88.238.32.102

🇺🇸 20.121.125.145