JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.14.93.166

185.14.93.166 was found in our database!

This IP was reported 95 times. Confidence of Abuse is 100%: ?

100%

ISP	GERLACH SYSTEMS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS48314
Domain Name	gerlach-systems.de
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.14.93.166

Whois 185.14.93.166

IP Abuse Reports for 185.14.93.166:

This IP address has been reported a total of 95 times from 80 distinct sources. 185.14.93.166 was first reported on May 11th 2026, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ecs.ge	2026-05-12 01:18:15 (3 weeks ago)	Automatic Fail2Ban report from jail ssh: multiple matching events detected.	Brute-Force SSH
Anonymous	2026-05-12 01:03:43 (3 weeks ago)	IP & Port Scan.	SSH Port Scan Brute-Force
🇹🇭 Sawasdee	2026-05-12 01:00:12 (3 weeks ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇺🇸 TPI-Abuse	2026-05-12 00:52:05 (3 weeks ago)	(mod_security) mod_security (id:218420) triggered by 185.14.93.166 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 185.14.93.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 20:51:57.716042 2026] [security2:error] [pid 28721:tid 28721] [client 185.14.93.166:36062] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.148:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.148"] [uri "/hello.world"] [unique_id "agJ5rf_BOJ10Cdw7SHipBQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 maxxsense	2026-05-12 00:45:53 (3 weeks ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 185.14.93.166 (DE/German ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 185.14.93.166 (DE/Germany/-) show less	Port Scan
🇩🇪 www.mammazone.it	2026-05-12 00:44:14 (3 weeks ago)	[Tue May 12 02:44:13.633161 2026] [core:error] [pid 2163454] [client 185.14.93.166:34504] AH10244: i ... show more [Tue May 12 02:44:13.633161 2026] [core:error] [pid 2163454] [client 185.14.93.166:34504] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh) [Tue May 12 02:44:13.662038 2026] [core:error] [pid 2163366] [client 185.14.93.166:34504] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh) ... show less	Hacking
🇩🇪 kingjan1999	2026-05-12 00:39:33 (3 weeks ago)	Blocked by UFW [2375/tcp] \| SPT: 63563 \| TTL: 55 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sef ... show more Blocked by UFW [2375/tcp] \| SPT: 63563 \| TTL: 55 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Finn	2026-05-12 00:24:59 (3 weeks ago)	2026-05-12T01:23:43.496505+01:00 frank sshd-session[3141302]: Invalid user orangepi from 185.14.93.1 ... show more 2026-05-12T01:23:43.496505+01:00 frank sshd-session[3141302]: Invalid user orangepi from 185.14.93.166 port 37062 2026-05-12T01:23:43.498263+01:00 frank sshd-session[3141302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.14.93.166 2026-05-12T01:23:46.067040+01:00 frank sshd-session[3141302]: Failed password for invalid user orangepi from 185.14.93.166 port 37062 ssh2 2026-05-12T01:24:56.616993+01:00 frank sshd-session[3142985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.14.93.166 user=root 2026-05-12T01:24:58.413616+01:00 frank sshd-session[3142985]: Failed password for root from 185.14.93.166 port 49026 ssh2 ... show less	Brute-Force SSH
🇫🇮 vereinshosting	2026-05-12 00:20:13 (3 weeks ago)	Invalid user admin from 185.14.93.166 port 57918	Brute-Force SSH
🇫🇷 terrae	2026-05-12 00:18:58 (3 weeks ago)	f2b automatic report	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-12 00:18:42 (3 weeks ago)	(mod_security) mod_security (id:218420) triggered by 185.14.93.166 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 185.14.93.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 20:18:37.612367 2026] [security2:error] [pid 3750:tid 3750] [client 185.14.93.166:48978] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.77:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.77"] [uri "/hello.world"] [unique_id "agJx3Zv2zxFdI-oDmN-88QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 NXTwoThou	2026-05-12 00:18:01 (3 weeks ago)	/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh	Web App Attack
🇺🇸 MPL	2026-05-12 00:14:47 (3 weeks ago)	tcp/443 (4 or more attempts)	Port Scan
🇩🇪 london2038.com	2026-05-12 00:08:30 (3 weeks ago)	Malformed or malicious web request 185.14.93.166 - - [12/May/2026:02:08:28 +0200] "POST /cgi-bin/.%2 ... show more Malformed or malicious web request 185.14.93.166 - - [12/May/2026:02:08:28 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 157 "-" "-" show less	Hacking Web App Attack
🇬🇧 venus.launch.bz	2026-05-11 23:58:39 (3 weeks ago)	(wpscan) WordPress probe detected from 185.14.93.166 (DE/Germany/-)	Hacking

Showing 31 to 45 of 95 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.214.24.232

🇮🇳 154.221.35.72

🇬🇧 35.203.211.38

🇬🇧 35.203.210.248

🇧🇪 34.14.117.241

🇨🇳 182.119.224.225

🇸🇬 159.89.207.47

🇨🇳 117.136.16.252

🇵🇱 87.99.104.251

🇺🇸 64.62.156.44

🇸🇬 47.128.20.131

🇦🇪 20.203.42.204

🇮🇳 1.187.75.19

🇰🇷 220.86.28.189

🇮🇩 202.51.208.195

🇺🇸 199.127.63.58

🇹🇼 198.235.24.32

🇺🇸 170.106.167.142

🇮🇩 124.40.252.3

🇨🇳 120.26.202.34