JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.213.229.66

185.213.229.66 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 36%: ?

36%

ISP	UNIVERSAL MOBILE SYSTEMS LCC
Usage Type	Mobile ISP
ASN	AS64466
Domain Name	mobi.uz
Country	🇺🇿 Uzbekistan
City	Tashkent, Tashkent

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.213.229.66

Whois 185.213.229.66

IP Abuse Reports for 185.213.229.66:

This IP address has been reported a total of 31 times from 23 distinct sources. 185.213.229.66 was first reported on July 23rd 2023, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 soverin	2026-06-16 19:06:07 (1 day ago)	spam	Email Spam
🇩🇪 botreporter	2026-06-12 05:53:25 (5 days ago)	botnet ignoring robots.txt	Bad Web Bot
🇳🇱 soverin	2026-06-05 15:32:03 (1 week ago)	spam	Email Spam
🇺🇸 oukat	2026-05-20 06:53:00 (4 weeks ago)	repeated sender=recipient email spoof attempts NOQUEUE: reject: RCPT from unknown[185.213.229.66] ... show more repeated sender=recipient email spoof attempts NOQUEUE: reject: RCPT from unknown[185.213.229.66]: 554 5.7.1 <[email protected]>: Sender address rejected: You are not me.; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[185.213.229.66]> show less	Email Spam Spoofing Phishing
Anonymous	2026-05-20 05:11:05 (4 weeks ago)	SpamAssassin score 25.7 exceeded block threshold 15.0	Email Spam
🇳🇱 Grad	2026-05-16 15:55:01 (1 month ago)	May 16 17:55:01 server postfix/smtpd[72001]: NOQUEUE: reject: RCPT from unknown[185.213.229.66]: 450 ... show more May 16 17:55:01 server postfix/smtpd[72001]: NOQUEUE: reject: RCPT from unknown[185.213.229.66]: 450 4.7.1 Client host rejected: cannot find your reverse hostname, [185.213.229.66]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[185.213.229.66]> ... show less	Email Spam Brute-Force
Anonymous	2026-05-16 09:25:50 (1 month ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-05-11 13:42:37 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 185.213.229.66 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.213.229.66 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 09:42:29.511617 2026] [security2:error] [pid 2216:tid 2216] [client 185.213.229.66:30909] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.213.229.66 (+1 hits since last alert)\|athletefirst.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "athletefirst.org"] [uri "/xmlrpc.php"] [unique_id "agHcxTTXw4V4scXBwe3u0QAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 PeravixGroup	2026-05-10 15:31:50 (1 month ago)	Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: ME ... show more Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud show less	IoT Targeted Brute-Force
🇬🇧 DWhile	2026-05-03 04:23:54 (1 month ago)	Spamassassin score over 10	Email Spam
🇮🇹 VHosting	2026-04-26 14:41:58 (1 month ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇮🇹 A000Z	2026-03-25 07:38:57 (2 months ago)	Fail2Ban: 185.213.229.66 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5 ... show more Fail2Ban: 185.213.229.66 was banned for Aggressive Bad Bot detected by Nginx/Fail2Ban. UA: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-20 16:36:15 (3 months ago)	(mod_security) mod_security (id:211030) triggered by 185.213.229.66 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211030) triggered by 185.213.229.66 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 11:36:07.725828 2026] [security2:error] [pid 25731:tid 26328] [client 185.213.229.66:62100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at ARGS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "17"] [id "211030"] [rev "3"] [msg "COMODO WAF: LDAP Injection Attack\|\|unitedonegroup.com\|F\|2"] [data "Matched Data: )>(/! found within ARGS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "unitedonegroup.com"] [uri "/bbs/faq.php"] [unique_id "aZiNd8DUGPrMYNhMpi-XHwAAAc4"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Birdo	2026-01-16 13:15:54 (5 months ago)	[Birdo SMB Honeypot] SMB unauthorized attempt	Port Scan Hacking Brute-Force Exploited Host
🇺🇸 MPL	2026-01-10 16:46:44 (5 months ago)	tcp/23 (2 or more attempts)	Port Scan

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 92.53.64.192

🇺🇸 207.90.244.17

🇨🇳 116.172.248.97

🇸🇬 103.187.146.33

🇮🇳 103.68.52.210

🇨🇳 101.42.46.71

🇳🇱 45.148.10.240

🇹🇼 45.121.48.110

🇺🇸 34.26.179.27

🇷🇴 2.57.121.25

🇮🇳 135.235.138.43

🇨🇳 124.174.44.175

🇬🇧 35.203.211.7

🇺🇸 16.58.56.214

🇺🇸 151.240.43.25

🇮🇳 103.211.18.48

🇱🇹 81.30.98.144

🇧🇷 43.164.197.97

🇳🇱 213.176.16.100

🇪🇹 196.189.3.1