JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 189.222.218.52

189.222.218.52 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 32%: ?

32%

ISP	Telefonos del Noroeste, S.A. de C.V.
Usage Type	Fixed Line ISP
ASN	AS8151
Hostname(s)	189.222.218.52.dsl.dyn.telnor.net
Domain Name	telnor.com
Country	🇲🇽 Mexico
City	Ensenada, Baja California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 189.222.218.52

Whois 189.222.218.52

IP Abuse Reports for 189.222.218.52:

This IP address has been reported a total of 16 times from 14 distinct sources. 189.222.218.52 was first reported on October 22nd 2021, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-06-08 12:50:52 (3 days ago)	ICS Labs identified 189.222.218.52 as a malicious indicator from threat intelligence.	DDoS Attack Hacking Brute-Force Exploited Host
🇨🇳 ThreatBook.io	2026-04-28 00:26:04 (1 month ago)	ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/189.222.218.52	SSH
🇨🇿 lp	2026-04-27 16:48:43 (1 month ago)	SSH Brute force: 48 attempts were recorded from 189.222.218.52 2026-04-27T17:17:48+02:00 Disconnecte ... show more SSH Brute force: 48 attempts were recorded from 189.222.218.52 2026-04-27T17:17:48+02:00 Disconnected from authenticating user root 189.222.218.52 port 52170 [preauth] 2026-04-27T17:19:13+02:00 Disconnected from authenticating user root 189.222.218.52 port 40030 [preauth] 2026-04-27T17:23:40+02:00 Disconnected from authenticating user root 189.222.218.52 port 60261 [preauth] 2026-04-27T17:28:05+02:00 Disconnected from authenticating user root 189.222.218.52 port 9931 [preauth] 2026-04-27T17:28:33+02:00 Disconnected from authenticating user root 189.222.218.52 port 33303 [preauth] 2026-04-27T17:29:49+02:00 Disconnected from authenticating user root 189.222.218.52 port 56012 [preauth] 2026-04-27T17:31:14+02:00 Disconnected from authenticating user root 189.222.218.52 port 53549 [preauth] 2026-04-27T17:31:39+02:00 Disconnected from authenticating user root 189.222.218.52 port 33356 [preauth show less	Brute-Force SSH
🇩🇪 LRob.fr	2026-04-27 15:30:08 (1 month ago)	SSH abuse or brute-force attack detected by Fail2Ban in ssh jail	Brute-Force SSH
🇹🇷 Threat.live	2026-04-27 15:25:04 (1 month ago)	Suspicious Connection Attempts	Brute-Force
🇫🇮 6kilowatti	2026-04-27 15:22:04 (1 month ago)	2026-04-27T18:22:01.638387+03:00 koti sshd[760216]: pam_unix(sshd:auth): authentication failure; log ... show more 2026-04-27T18:22:01.638387+03:00 koti sshd[760216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.222.218.52 user=root 2026-04-27T18:22:03.904730+03:00 koti sshd[760216]: Failed password for root from 189.222.218.52 port 59389 ssh2 ... show less	Brute-Force SSH
🇩🇪 Sequell.de	2026-04-27 15:20:53 (1 month ago)	SSH brute-force attempt (Username: root)	Brute-Force SSH
🇺🇸 bigscoots.com	2026-04-27 15:17:34 (1 month ago)	189.222.218.52 (MX/Mexico/189.222.218.52.dsl.dyn.telnor.net), 5 distributed sshd attacks on account ... show more 189.222.218.52 (MX/Mexico/189.222.218.52.dsl.dyn.telnor.net), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Apr 27 10:11:54 15506 sshd[23165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.123.249.114 user=root Apr 27 10:11:55 15506 sshd[23165]: Failed password for root from 39.123.249.114 port 58558 ssh2 Apr 27 09:28:51 15506 sshd[20038]: Failed password for root from 103.172.204.220 port 54490 ssh2 Apr 27 10:17:12 15506 sshd[23582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.222.218.52 user=root Apr 27 10:17:14 15506 sshd[23582]: Failed password for root from 189.222.218.52 port 32809 ssh2 IP Addresses Blocked: 39.123.249.114 (KR/South Korea/-) 103.172.204.220 (ID/Indonesia/ip103-172-204-220.cloudhost.web.id) show less	Brute-Force SSH
🇩🇪 akasolutions.de	2026-04-25 17:37:44 (1 month ago)	(sshd) Failed SSH login from 189.222.218.52 (MX/Mexico/189.222.218.52.dsl.dyn.telnor.net)	Brute-Force SSH
🇩🇪 ghostwarriors	2026-04-25 16:50:15 (1 month ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇨🇿 lp	2026-04-25 16:48:43 (1 month ago)	SSH Brute force: 21 attempts were recorded from 189.222.218.52 2026-04-25T18:19:10+02:00 Disconnecte ... show more SSH Brute force: 21 attempts were recorded from 189.222.218.52 2026-04-25T18:19:10+02:00 Disconnected from authenticating user root 189.222.218.52 port 23997 [preauth] 2026-04-25T18:22:16+02:00 Disconnected from authenticating user root 189.222.218.52 port 37515 [preauth] 2026-04-25T18:23:35+02:00 Disconnected from authenticating user root 189.222.218.52 port 53589 [preauth] 2026-04-25T18:25:56+02:00 Disconnected from authenticating user root 189.222.218.52 port 35064 [preauth] 2026-04-25T18:26:47+02:00 Disconnected from authenticating user root 189.222.218.52 port 10962 [preauth] 2026-04-25T18:27:06+02:00 Disconnected from authenticating user root 189.222.218.52 port 57556 [preauth] 2026-04-25T18:29:06+02:00 Invalid user ftptest2 from 189.222.218.52 port 26747 2026-04-25T18:29:55+02:00 Invalid user ftptest2 from 189.222.218.52 port 52912 2026-04-25T18:30:15+02:00 Invalid user ftptest2 f show less	Brute-Force SSH
🇩🇪 Ariazonaa	2026-04-25 16:27:45 (1 month ago)	Fail2Ban host=kvm518290 jail=sshd failures=6. Login abuse observed. sample=2026-04-25T18:14:30.79936 ... show more Fail2Ban host=kvm518290 jail=sshd failures=6. Login abuse observed. sample=2026-04-25T18:14:30.799364+02:00 kvm518290 sshd-session[66091]: Disconnected from authenticating user root 189.222.218.52 port 6018 [preauth] 2026-04-25T18:17:37.623848+02:00 kvm518290 sshd-session[66182]: Disconnected from authenticating user root 189.222.218.52 port 18591 [preauth] 2026-04-25T18:19:29.680449+02:00 kvm518290 sshd-session[66232]: Disconnected from authenticating user root 189.222.218.52 port 37268 [preauth] 2026-04-25T18:24:34.185703+02:00 kvm518290 sshd-session[66367]: Disconne show less	Brute-Force SSH
Anonymous	2026-04-25 16:26:15 (1 month ago)	$f2bV_matches	Brute-Force SSH
🇯🇵 stypr	2026-04-25 16:24:39 (1 month ago)	SSH Bruteforcing Attempt / Port Scanning	Brute-Force SSH
🇺🇸 bigscoots.com	2026-04-25 16:15:56 (1 month ago)	189.222.218.52 (MX/Mexico/189.222.218.52.dsl.dyn.telnor.net), 6 distributed sshd attacks on account ... show more 189.222.218.52 (MX/Mexico/189.222.218.52.dsl.dyn.telnor.net), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Apr 25 16:15:33 23159 sshd[13796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.222.218.52 user=root Apr 25 16:05:00 23159 sshd[12883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.229.150.140 user=root Apr 25 16:05:02 23159 sshd[12883]: Failed password for root from 89.229.150.140 port 36514 ssh2 Apr 25 16:09:07 23159 sshd[13277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.229.150.140 user=root Apr 25 16:07:13 23159 sshd[13122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.229.150.140 user=root Apr 25 16:07:15 23159 sshd[13122]: Failed password for root from 89.229.150.140 port 52978 ssh2 IP Addresses Blocked: show less	Brute-Force SSH

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 218.149.228.147

🇺🇸 209.90.232.26

🇺🇸 207.200.18.74

🇨🇳 101.76.248.214

🇫🇷 91.231.89.244

🇩🇪 64.188.83.134

🇺🇸 47.251.167.26

🇳🇱 45.148.10.141

🇳🇱 213.177.179.12

🇰🇷 211.246.160.21

🇰🇷 210.105.93.136

🇲🇿 196.28.226.124

🇬🇧 195.140.214.20

🇺🇸 147.185.132.47

🇲🇽 104.243.245.206

🇺🇸 35.88.62.40

🇷🇺 31.173.2.33

🇨🇳 222.247.32.186

🇩🇪 213.209.159.56

🇬🇧 193.163.125.77