JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

201.165.152.84

Recent Activity

Abuse Confidence Score

46% Elevated

33 reports

24 reporters · latest 7 hours ago

ISP: Mega Cable, S.A. de C.V.
Usage Type: Fixed Line ISP
ASN: AS13999
Hostname(s): customer-scdc-mca-152-84.megared.net.mx
Domain Name: mega.mx
Country: 🇲🇽 Mexico
City: San Cristobal de las Casas, Chiapas

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

33 from 24 distinct reporters

First reported

May 15th 2026

Most recent report

7 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 4 🇩🇪 Germany 3 🇨🇿 Czechia 2

Most common categories Brute-Force 8 Bad Web Bot 5 Web App Attack 5 Hacking 4 DDoS Attack 3

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-11-11 05:06:31 UTC · (7 hours ago)	Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader \| path: /Shieldlist/shieldlist-controller/blame/commit/f3eb72397f68b2e29dac404cb9843c00b65752bd/internal/config/secrets_mask_test.go \| src_port: 9276 \| ua: Mozilla/5.0 ... show more Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader \| path: /Shieldlist/shieldlist-controller/blame/commit/f3eb72397f68b2e29dac404cb9843c00b65752bd/internal/config/secrets_mask_test.go \| src_port: 9276 \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	DDoS Attack Bad Web Bot
🇺🇸 seb6062	2026-11-07 03:05:34 UTC · (4 days ago)	SSH tarpit on port 22: 2 connection(s) in the last 24h, held 1050 s in total, longest 1030 s. Unsolicited SSH to a port with no SSH service: SSH client held by the tarpit (brute-force tool behavior). Automated endlessh tarpit report.	Brute-Force SSH
🇨🇿 Countryman	2026-11-06 01:10:01 UTC · (5 days ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
Anonymous	2026-11-04 23:15:04 UTC · (6 days ago)	Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group \| Catalog Search Abuse Blocked: /catalogsearch/result/?cat=5+&iptel_type=174&mode=list&product_vc_type=101&q=ex+90&rating=6 \| UA: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/6808-09-22 00:34:00.210663 Firefox/10.0 \| (Magento Site) show less	Hacking Bad Web Bot
🇨🇿 Countryman	2026-11-04 01:10:06 UTC · (1 week ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-10-22 11:47:23 UTC · (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 201.165.152.84 (customer-SCDC-MCA-152-84.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 07:47:16.078820 2026] [security2:error] [pid 12922:ti ... show more (mod_security) mod_security (id:225170) triggered by 201.165.152.84 (customer-SCDC-MCA-152-84.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 07:47:16.078820 2026] [security2:error] [pid 12922:tid 12922] [client 201.165.152.84:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|avaliantlife.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "avaliantlife.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atn3xGrTN_9LHflY6w6_kQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-21 23:20:34 UTC · (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 201.165.152.84 (customer-SCDC-MCA-152-84.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 19:20:27.216171 2026] [security2:error] [pid 12419:ti ... show more (mod_security) mod_security (id:225170) triggered by 201.165.152.84 (customer-SCDC-MCA-152-84.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 19:20:27.216171 2026] [security2:error] [pid 12419:tid 12419] [client 201.165.152.84:40371] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|seahattravel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "seahattravel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "atlIu6XWSiHk1C0PEp6zCQAAAC4"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 ALPHANET	2026-10-17 06:15:44 UTC · (3 weeks ago)	Botnet or web spider not respecting robots.txt	DDoS Attack Exploited Host
🇲🇹 Malta	2026-10-17 03:51:03 UTC · (3 weeks ago)	201.165.152.84 - - [17/Oct/2026:05:51:03 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" Brute-force password attempt	Hacking Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-10-14 11:35:48 UTC · (4 weeks ago)	(mod_security) mod_security (id:225170) triggered by 201.165.152.84 (customer-SCDC-MCA-152-84.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:35:40.532439 2026] [security2:error] [pid 7344:tid ... show more (mod_security) mod_security (id:225170) triggered by 201.165.152.84 (customer-SCDC-MCA-152-84.megared.net.mx): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 07:35:40.532439 2026] [security2:error] [pid 7344:tid 7344] [client 201.165.152.84:63532] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.sbip.loneoakhoney.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.sbip.loneoakhoney.com"] [uri "/wp-json/wp/v2/users"] [unique_id "as9pDKTrzNhZR_5yDFpaYAAAACg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Packets-Decreaser.NET	2026-10-11 01:11:23 UTC · (1 month ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇵🇱 bmino.pl	2026-10-10 18:16:43 UTC · (1 month ago)	Autoban IP(2): 201.165.152.84 - Hostname: Mega Cable, S.A. de C.V. - City: San Cristóbal de las Casas - Country: Mexico - Organization: Mega Cable, S.A. de C.V - Reason: GET /?c=tmieq173t1473octyqwpgt HTTP/1.1	Web App Attack
🇩🇪 phil2k	2026-09-14 11:52:49 UTC · (1 month ago)	Firewall: Within 2026-08-01 16:39:01 - 2026-08-15 14:28:56 CEST(+0200) identified: unallowed access from 201.165.152.84 on uncommon port/s: 39883(udp:39883),30004(udp:30004) (2 trials)	Port Scan Brute-Force
🇳🇮 elfita	2026-08-26 06:36:02 UTC · (2 months ago)	Blocked by nftables on AmneziaWG gateway	Port Scan Brute-Force Exploited Host
🇺🇸 鬼影233	2026-08-25 00:05:38 UTC · (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0	Bad Web Bot

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇩 183.91.83.132

🇧🇷 179.48.18.42

🇺🇸 164.68.129.36

🇺🇸 98.174.60.201

🇫🇷 91.231.89.202

🇺🇸 209.95.124.252

🇺🇸 165.154.134.203

🇸🇬 161.120.175.72

🇳🇱 93.123.109.95

🇷🇴 2.57.121.112

🇬🇧 2a06:4884:d000::fb

🇺🇸 162.252.54.162

🇵🇰 154.192.130.49

🇸🇬 104.248.154.211

🇵🇹 89.153.179.152

🇮🇱 87.71.127.112

🇩🇪 85.155.14.247

🇺🇸 68.225.56.110

🇨🇳 58.242.117.176

🇨🇦 34.118.151.74