JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 189.206.21.221

189.206.21.221 was found in our database!

This IP was reported 81 times. Confidence of Abuse is 56%: ?

56%

ISP	Alestra, S. de R.L. de C.V.
Usage Type	Fixed Line ISP
ASN	AS11172
Hostname(s)	static-21.206.189-221.alestra.net.mx
Domain Name	alestra.com.mx
Country	🇲🇽 Mexico
City	Cardenas, Tabasco

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 189.206.21.221

Whois 189.206.21.221

IP Abuse Reports for 189.206.21.221:

This IP address has been reported a total of 81 times from 40 distinct sources. 189.206.21.221 was first reported on May 30th 2024, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 netclix.gr	2026-10-12 01:29:00 (5 days ago)	(fake_mac) Blocked fake Macintosh Chrome 189.206.21.221 (MX/Mexico/static-21.206.189-221.alestra.net ... show more (fake_mac) Blocked fake Macintosh Chrome 189.206.21.221 (MX/Mexico/static-21.206.189-221.alestra.net.mx) show less	Hacking
🇺🇸 micropedro	2026-10-11 13:53:16 (5 days ago)	3 incidents: malicious activity. First: 2026-10-02 11:28, Last: 2026-10-11 09:53 UTC. Triggers: unkn ... show more 3 incidents: malicious activity. First: 2026-10-02 11:28, Last: 2026-10-11 09:53 UTC. Triggers: unknown. show less	Port Scan
🇺🇸 TPI-Abuse	2026-10-06 05:17:59 (1 week ago)	(mod_security) mod_security (id:210350) triggered by 189.206.21.221 (static-21.206.189-221.alestra.n ... show more (mod_security) mod_security (id:210350) triggered by 189.206.21.221 (static-21.206.189-221.alestra.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 01:17:55.723759 2026] [security2:error] [pid 27121:tid 27133] [client 189.206.21.221:34454] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|ejspizzeriahudson.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ejspizzeriahudson.com"] [uri "/"] [unique_id "asSEg889R-zC5D26eCfMLAAAAEo"], referer: https://automaticbacklinkgenerator.online/dir/trusted-seo-backlinks-62804 show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 ALPHANET	2026-10-05 01:11:39 (1 week ago)	Botnet or web spider not respecting robots.txt	DDoS Attack Exploited Host
🇩🇪 Vegascosmetics	2026-10-05 00:38:58 (1 week ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local blo ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (63, Abuse: 56) show less	Hacking Exploited Host Web App Attack
🇫🇷 Petre 21_ip	2026-10-04 17:05:38 (1 week ago)	2026-10-04T19:05:37.871688+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c ... show more 2026-10-04T19:05:37.871688+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=189.206.21.221 DST=155.133.26.57 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=34242 DF PROTO=UDP SPT=58106 DPT=43228 LEN=40 ... show less	Port Scan
🇺🇸 TPI-Abuse	2026-10-04 10:21:49 (1 week ago)	(mod_security) mod_security (id:210350) triggered by 189.206.21.221 (static-21.206.189-221.alestra.n ... show more (mod_security) mod_security (id:210350) triggered by 189.206.21.221 (static-21.206.189-221.alestra.net.mx): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 06:21:44.983151 2026] [security2:error] [pid 7221:tid 7221] [client 189.206.21.221:39632] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|jazzycatty.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jazzycatty.com"] [uri "/"] [unique_id "asIouLt51oU-5TmN4JXR7AAAABA"], referer: https://generatehighqualitybacklinks.website/dir/advanced-link-building-105432 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 micropedro	2026-10-02 15:28:14 (2 weeks ago)	3 incidents: malicious activity. First: 2026-09-29 18:52, Last: 2026-10-02 11:28 UTC. Triggers: unkn ... show more 3 incidents: malicious activity. First: 2026-09-29 18:52, Last: 2026-10-02 11:28 UTC. Triggers: unknown. show less	Port Scan
Anonymous	2026-10-02 12:21:25 (2 weeks ago)	denied traffic to a non-approved destination port. destination port 34209.	Port Scan
🇺🇸 micropedro	2026-09-29 23:18:07 (2 weeks ago)	3 incidents: malicious activity. First: 2026-09-29 18:52, Last: 2026-09-29 19:18 UTC. Triggers: unkn ... show more 3 incidents: malicious activity. First: 2026-09-29 18:52, Last: 2026-09-29 19:18 UTC. Triggers: unknown. show less	Port Scan
🇭🇰 CyberFox	2026-09-29 12:38:30 (2 weeks ago)	16816/udp (1 or more attempts)	Port Scan
🇺🇸 鬼影233	2026-09-24 16:31:59 (3 weeks ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 micropedro	2026-09-24 14:15:29 (3 weeks ago)	3 incidents: malicious activity. First: 2026-09-09 19:50, Last: 2026-09-24 10:15 UTC. Triggers: unkn ... show more 3 incidents: malicious activity. First: 2026-09-09 19:50, Last: 2026-09-24 10:15 UTC. Triggers: unknown. show less	Port Scan
🇺🇸 micropedro	2026-09-24 14:15:05 (3 weeks ago)	3 incidents: malicious activity. First: 2026-09-22 20:16, Last: 2026-09-24 10:15 UTC. Triggers: unkn ... show more 3 incidents: malicious activity. First: 2026-09-22 20:16, Last: 2026-09-24 10:15 UTC. Triggers: unknown. show less	Port Scan
🇺🇸 鬼影233	2026-09-21 21:34:58 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot

Showing 1 to 15 of 81 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 220.119.37.141

🇨🇦 185.216.20.207

🇳🇱 160.119.76.31

🇺🇸 129.213.151.234

🇧🇬 213.91.182.247

🇺🇸 207.32.153.204

🇮🇳 202.142.121.99

🇲🇽 201.124.60.211

🇺🇸 192.145.68.172

🇰🇷 175.209.156.146

🇨🇳 125.86.23.138

🇮🇳 122.187.224.28

🇮🇳 113.11.231.104

🇪🇸 104.250.211.5

🇧🇩 103.74.230.202

🇷🇴 92.118.39.86

🇬🇧 86.38.187.198

🇫🇷 82.96.132.199

🇮🇹 82.88.161.85

🇺🇸 46.183.212.118