JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

182.85.168.130

Neutral Activity

Abuse Confidence Score

0% Low Risk

23 reports

20 reporters · latest 7 months ago

ISP: CHINANET JIANGXI PROVINCE NETWORK
Usage Type: Fixed Line ISP
ASN: AS4134
Domain Name: bta.net.cn
Country: 🇨🇳 China
City: Nanchang, Jiangxi

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

182.85.168.130 has been reported 23 times. The most recent report is from 7 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

23 from 20 distinct reporters

First reported

March 19th 2026

Most recent report

7 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 lp	2026-03-20 09:38:43 UTC · (7 months ago)	SSH Brute force: 1 attempts were recorded from 182.85.168.130 2026-03-19T05:06:22+01:00 Invalid user admin from 182.85.168.130 port 53902	Brute-Force SSH
🇨🇳 ThreatBook.io	2026-03-20 01:42:56 UTC · (7 months ago)	ThreatBook Intelligence: vpn_proxy,Dynamic IP more details on https://threatbook.io/ip/182.85.168.130	SSH
🇹🇷 rtbh.com.tr	2026-03-19 20:12:09 UTC · (7 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇫🇮 tjs	2026-03-19 11:50:00 UTC · (7 months ago)	web attack, shell attempt	Hacking Web App Attack
Anonymous	2026-03-19 06:56:17 UTC · (7 months ago)	Unauthorized connection to Telnet port 23	Port Scan
🇫🇷 security.rdmc.fr	2026-03-19 06:42:37 UTC · (7 months ago)	Port Scan Attack proto:TCP src:52885 dst:23	Port Scan
🇨🇳 kipfel★	2026-03-19 06:42:06 UTC · (7 months ago)	2026-03-19T14:15:30.300003+08:00 self-dedi-wyse-5070-tna sshd-session[455676]: Invalid user user from 182.85.168.130 port 35710 2026-03-19T14:28:36.146461+08:00 self-dedi-wyse-5070-tna sshd-session[456788]: Invalid user user from 182.85.168.130 port ... show more 2026-03-19T14:15:30.300003+08:00 self-dedi-wyse-5070-tna sshd-session[455676]: Invalid user user from 182.85.168.130 port 35710 2026-03-19T14:28:36.146461+08:00 self-dedi-wyse-5070-tna sshd-session[456788]: Invalid user user from 182.85.168.130 port 37150 2026-03-19T14:42:05.160953+08:00 self-dedi-wyse-5070-tna sshd-session[457923]: Invalid user admin from 182.85.168.130 port 39898 ... show less	Brute-Force SSH
Anonymous	2026-03-19 06:41:16 UTC · (7 months ago)	Unauthorized connection to SSH port 22	Port Scan SSH
🇺🇸 RAP	2026-03-19 06:35:34 UTC · (7 months ago)	2026-03-19 06:35:34 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇺🇸 TPI-Abuse	2026-03-19 06:27:48 UTC · (7 months ago)	(mod_security) mod_security (id:218420) triggered by 182.85.168.130 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 02:27:41.008518 2026] [security2:error] [pid 20076:tid 20076] [client 182.85.168.130:45036] ... show more (mod_security) mod_security (id:218420) triggered by 182.85.168.130 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 02:27:41.008518 2026] [security2:error] [pid 20076:tid 20076] [client 182.85.168.130:45036] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.47:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.47"] [uri "/hello.world"] [unique_id "abuXXWZhuEsYFbmmJyKOXQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-03-19 06:20:51 UTC · (7 months ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇺🇸 SANYALnet Labs	2026-03-19 06:06:23 UTC · (7 months ago)	Mar 19 06:06:19 sanyalnet-oracle-vps2 sshd[2456151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.85.168.130 Mar 19 06:06:21 sanyalnet-oracle-vps2 sshd[2456151]: Failed password for invalid user admin f ... show more Mar 19 06:06:19 sanyalnet-oracle-vps2 sshd[2456151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.85.168.130 Mar 19 06:06:21 sanyalnet-oracle-vps2 sshd[2456151]: Failed password for invalid user admin from 182.85.168.130 port 53590 ssh2 Mar 19 06:06:22 sanyalnet-oracle-vps2 sshd[2456151]: Connection closed by invalid user admin 182.85.168.130 port 53590 [preauth] ... show less	Brute-Force
🇳🇱 EGP Abuse Dept	2026-03-19 05:52:05 UTC · (7 months ago)	Unauthorized connection to SSH port 22	Port Scan Hacking SSH
🇨🇭 dalslab ltd	2026-03-19 05:51:06 UTC · (7 months ago)	182.85.168.130 - - [19/Mar/2026:06:50:54 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 154 "-" "-" 182.85.168.130 - - [19/Mar/2026:06:50:59 +0100] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32 ... show more 182.85.168.130 - - [19/Mar/2026:06:50:54 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 154 "-" "-" 182.85.168.130 - - [19/Mar/2026:06:50:59 +0100] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 154 "-" "-" 182.85.168.130 - - [19/Mar/2026:06:51:04 +0100] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 154 "-" "-" 182.85.168.130 - - [19/Mar/2026:06:51:04 +0100] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 405 154 "-" "libredtail-http" 182.85.168.130 - - [19/Mar/2026:06:51:05 +0100] "POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 405 154 "-" "libredtail-http" ... show less	Web Spam Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-03-19 05:50:52 UTC · (7 months ago)	unsolicited connect TCP dport 23 (sport 64482)	Hacking

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇫🇮 185.89.42.156

🇹🇭 165.154.119.158

🇩🇿 154.251.134.147

🇧🇩 103.159.2.113

🇳🇱 77.239.124.171

🇿🇦 20.87.218.237

🇧🇷 201.86.42.211

🇳🇱 185.242.226.59

🇳🇱 185.218.86.14

🇺🇸 157.22.127.62

🇳🇱 93.123.109.82

🇩🇪 69.5.169.55

🇬🇧 35.203.210.86

🇨🇦 4.206.92.183

🇹🇭 1.4.135.5

🇨🇳 223.91.91.144

🇲🇾 202.186.65.20

🇦🇷 186.122.89.238

🇺🇸 172.236.228.229

🇩🇪 172.70.243.65