JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 132.243.221.226

132.243.221.226 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	QWINS Hosting
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213702
Domain Name	qwins.co
Country	🇳🇱 Netherlands
City	Kerkrade, Limburg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 132.243.221.226

Whois 132.243.221.226

IP Abuse Reports for 132.243.221.226:

This IP address has been reported a total of 28 times from 25 distinct sources. 132.243.221.226 was first reported on June 18th 2026, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇴 tmiland	2026-06-21 15:37:49 (5 days ago)	Suricata Detected 12 attacks from 132.243.221.226.; ET SCAN Potential SSH Scan; IP: 132.243.221.226; ... show more Suricata Detected 12 attacks from 132.243.221.226.; ET SCAN Potential SSH Scan; IP: 132.243.221.226; Ports: 45134; Direction: to_server; Trigger: SCAN; Category: Attempted Information Leak; Severity: 2 show less	Port Scan
🇳🇴 tmiland	2026-06-21 15:22:23 (5 days ago)	Suricata Detected 118 attacks from 132.243.221.226.; ET SCAN LibSSH Based Frequent SSH Connections L ... show more Suricata Detected 118 attacks from 132.243.221.226.; ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack; IP: 132.243.221.226; Ports: 53590; Direction: to_server; Trigger: SCAN; Category: Attempted Administrator Privilege Gain; Severity: 1 show less	Port Scan
🇦🇹 urnilxfgbez	2026-06-18 22:45:00 (1 week ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇬🇧 Astro	2026-06-18 06:05:28 (1 week ago)	SSH unauthorized access. Fail2Ban trigger ...	Brute-Force SSH
🇸🇬 zypA13510	2026-06-18 05:44:29 (1 week ago)	2026-06-18T05:38:08.503772+00:00 sgp01 sshd[1342269]: Invalid user admin from 132.243.221.226 port 3 ... show more 2026-06-18T05:38:08.503772+00:00 sgp01 sshd[1342269]: Invalid user admin from 132.243.221.226 port 34540 2026-06-18T05:38:39.571102+00:00 sgp01 sshd[1342283]: Invalid user orangepi from 132.243.221.226 port 37704 2026-06-18T05:42:24.235512+00:00 sgp01 sshd[1342586]: Invalid user test from 132.243.221.226 port 57602 2026-06-18T05:42:55.291124+00:00 sgp01 sshd[1342593]: Invalid user user from 132.243.221.226 port 52400 2026-06-18T05:44:28.381448+00:00 sgp01 sshd[1342615]: Invalid user admin from 132.243.221.226 port 33730 ... show less	Brute-Force SSH
🇹🇭 MWA SOC	2026-06-18 05:38:17 (1 week ago)		Hacking
🇨🇦 KIsmay	2026-06-18 04:49:39 (1 week ago)	Jun 17 21:49:02 ismay sshd[2176444]: Invalid user orangepi from 132.243.221.226 port 55808 Jun 17 21 ... show more Jun 17 21:49:02 ismay sshd[2176444]: Invalid user orangepi from 132.243.221.226 port 55808 Jun 17 21:49:02 ismay sshd[2176444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.243.221.226 Jun 17 21:49:04 ismay sshd[2176444]: Failed password for invalid user orangepi from 132.243.221.226 port 55808 ssh2 Jun 17 21:49:37 ismay sshd[2176461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.243.221.226 user=root Jun 17 21:49:39 ismay sshd[2176461]: Failed password for root from 132.243.221.226 port 39678 ssh2 ... show less	Brute-Force SSH
🇨🇿 lp	2026-06-18 04:48:59 (1 week ago)	SSH Brute force: 91 attempts were recorded from 132.243.221.226 2026-06-18T05:21:31+02:00 Invalid us ... show more SSH Brute force: 91 attempts were recorded from 132.243.221.226 2026-06-18T05:21:31+02:00 Invalid user admin from 132.243.221.226 port 42980 2026-06-18T05:22:02+02:00 Invalid user orangepi from 132.243.221.226 port 34166 2026-06-18T05:23:03+02:00 Connection closed by authenticating user root 132.243.221.226 port 45038 [preauth] 2026-06-18T05:23:34+02:00 Connection closed by authenticating user root 132.243.221.226 port 59498 [preauth] 2026-06-18T05:24:12+02:00 Connection closed by authenticating user root 132.243.221.226 port 52810 [preauth] 2026-06-18T05:24:42+02:00 Connection closed by authenticating user root 132.243.221.226 port 49246 [preauth] 2026-06-18T05:25:19+02:00 Connection closed by authenticating user root 132.243.221.226 port 47758 [preauth] 2026-06-18T05:25:53+02:00 Connection closed by authenticating user root 132.243.221.226 port 40718 [preauth] 2026-06-18T05:26:23+02:00 show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-06-18 04:45:54 (1 week ago)	(mod_security) mod_security (id:218420) triggered by 132.243.221.226 (vm135317.hosted-by.qwins.co): ... show more (mod_security) mod_security (id:218420) triggered by 132.243.221.226 (vm135317.hosted-by.qwins.co): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 00:45:51.397530 2026] [security2:error] [pid 18865:tid 18865] [client 132.243.221.226:50170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.173:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.173"] [uri "/hello.world"] [unique_id "ajN3_6-64K_NXeIcybTepgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 COMPLEX	2026-06-18 04:25:15 (1 week ago)	Banned by Multi Agent · node …dqmb · attempts=5 · SSH brute-force / scan	Brute-Force SSH
🇩🇪 NetWatch	2026-06-18 04:16:58 (1 week ago)	The IP 132.243.221.226 tried multiple SSH_BRUTE_FORCE logins	Brute-Force
🇪🇸 masterguru	2026-06-18 04:16:33 (1 week ago)	(sshd) Failed SSH login from 132.243.221.226 (NL/The Netherlands/vm135317.hosted-by.qwins.co): 5 in ... show more (sshd) Failed SSH login from 132.243.221.226 (NL/The Netherlands/vm135317.hosted-by.qwins.co): 5 in the last 3600 secs (0-167) show less	Hacking
🇳🇱 BIV	2026-06-18 04:16:20 (1 week ago)	Honeypot multi-source hit. Sources: tpot:Fatt,tpot:P0f,tpot:Suricata,tpot:Tanner. Ports: 80. Automat ... show more Honeypot multi-source hit. Sources: tpot:Fatt,tpot:P0f,tpot:Suricata,tpot:Tanner. Ports: 80. Automated tiered (T-Pot+DShield). show less	Port Scan Hacking Bad Web Bot
🇺🇸 MPL	2026-06-18 03:56:38 (1 week ago)	tcp/22 (2 or more attempts)	Port Scan
🇩🇪 EGP Abuse Dept	2026-06-18 03:56:14 (1 week ago)	Scanning for web/db/file exploits on tpc-002.mach3builders.nl	SQL Injection Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 176.65.149.236

🇫🇷 173.249.52.138

🇩🇪 167.94.146.52

🇺🇸 153.66.225.15

🇨🇱 138.186.9.20

🇺🇸 130.51.131.45

🇨🇳 60.16.211.212

🇨🇳 60.16.211.114

🇬🇧 45.82.76.124

🇺🇸 45.33.105.182

🇵🇰 203.135.42.52

🇺🇸 198.23.249.85

🇳🇱 193.176.31.251

🇮🇩 182.2.177.216

🇫🇷 91.231.89.254

🇳🇱 89.21.67.139

🇭🇺 84.225.72.43

🇳🇱 81.19.216.118

🇮🇹 78.134.49.171

🇺🇸 66.132.224.22