JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.132.172.128

66.132.172.128 was found in our database!

This IP was reported 3,367 times. Confidence of Abuse is 100%: ?

100%

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Hostname(s)	128.172.132.66.censys-scanner.com
Domain Name	censys.io
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.132.172.128

Whois 66.132.172.128

IP Abuse Reports for 66.132.172.128:

This IP address has been reported a total of 3,367 times from 571 distinct sources. 66.132.172.128 was first reported on March 19th 2026, and the most recent report was 6 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Misaka13514	2026-06-29 23:44:18 (6 minutes ago)	SSH tarpit connection (endlessh): 2026-06-29T23:44:18.017Z ACCEPT host=::ffff:66.132.172.128 port=64 ... show more SSH tarpit connection (endlessh): 2026-06-29T23:44:18.017Z ACCEPT host=::ffff:66.132.172.128 port=64392 fd=4 n=4/4096 show less	Brute-Force SSH
🇺🇸 MPL	2026-06-29 22:18:07 (1 hour ago)	tcp/51443 (6 or more attempts)	Port Scan
🇩🇪 dispaisyenterprises	2026-06-29 21:51:48 (1 hour ago)	Honeypot [fra-de-honeypot]: Empty payload (likely service probe); 4445 [1] TCP Reported by DisPaisy ... show more Honeypot [fra-de-honeypot]: Empty payload (likely service probe); 4445 [1] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇺🇸 NetGuard	2026-06-29 21:39:32 (2 hours ago)	#honeypot #netguard247 #cowrie #sshtelnetprobe Captured by NetGuard 24/7 T-Pot honeypot (netguard24- ... show more #honeypot #netguard247 #cowrie #sshtelnetprobe Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com). Timestamp: 2026-06-29T21:39:32.791+00:00 Attacker IP: 66.132.172.128 \| Port: N/A \| Country: United States Honeypot: cowrie \| Attack: ssh_telnet_probe Source: NetGuard 24/7 (netguard24-7.com) \| PhantomGrid Defense show less	Brute-Force SSH
🇩🇪 David Ferneding	2026-06-29 20:42:48 (3 hours ago)	Blocked by UFW (TCP on 111) Source port: 4438 TTL: 57 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 111) Source port: 4438 TTL: 57 Packet length: 60 TOS: 0x00 This report (for 66.132.172.128) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇭🇰 sandra361	2026-06-29 20:29:21 (3 hours ago)	Port scan detected: 11 attempts across 1 ports (8080). \| Evidence: REAPER_TARPIT: IN=eth0 SRC=66.132 ... show more Port scan detected: 11 attempts across 1 ports (8080). \| Evidence: REAPER_TARPIT: IN=eth0 SRC=66.132.172.128 LEN=60 TOS=0x14 PREC=0x00 TTL=50 ID=14896 DF PROTO=TCP SPT=33548 DPT=8080 WINDOW=21900 RES=0x00 SYN URGP=0 show less	Port Scan
🇺🇸 mutebot.net	2026-06-29 20:11:31 (3 hours ago)	SRC=66.132.172.128, PROTO=TCP, SPT=33778, DPT=25	Port Scan
🇫🇷 sthoyer.de	2026-06-29 20:07:45 (3 hours ago)	Jun 29 22:07:45 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f ... show more Jun 29 22:07:45 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=66.132.172.128 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=38052 DF PROTO=TCP SPT=36316 DPT=21 WINDOW=21900 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇧🇷 diego	2026-06-29 19:54:22 (3 hours ago)	[rede-164-29] 06/29/2026-16:54:22.534547, 66.132.172.128, Protocol: 6, ET DROP Dshield Block Listed ... show more [rede-164-29] 06/29/2026-16:54:22.534547, 66.132.172.128, Protocol: 6, ET DROP Dshield Block Listed Source group 1 show less	Hacking
🇩🇪 30p87	2026-06-29 19:36:36 (4 hours ago)	2026-06-29T21:36:35.142292+02:00 30p87-server sshd-session[1878328]: Unable to negotiate with 66.132 ... show more 2026-06-29T21:36:35.142292+02:00 30p87-server sshd-session[1878328]: Unable to negotiate with 66.132.172.128 port 43890: no matching MAC found. Their offer: hmac-sha2-256,hmac-sha1,hmac-sha1-96 [preauth] ... show less	Brute-Force SSH
🇧🇷 diego	2026-06-29 19:15:20 (4 hours ago)	[probe-44-49] 2026-06-29 18:59:17, Client: 66.132.172.128, Protocol: 6, Unauthorized activity to HTT ... show more [probe-44-49] 2026-06-29 18:59:17, Client: 66.132.172.128, Protocol: 6, Unauthorized activity to HTTP: GET / show less	Web App Attack
🇫🇷 sthoyer.de	2026-06-29 19:10:41 (4 hours ago)	Jun 29 21:10:39 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ... show more Jun 29 21:10:39 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=66.132.172.128 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=55167 DF PROTO=TCP SPT=1770 DPT=5005 WINDOW=21900 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇫🇷 0xNath	2026-06-29 17:51:18 (5 hours ago)	2026-06-29T19:51:12.554798+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connectio ... show more 2026-06-29T19:51:12.554798+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.172.128, lip=192.168.1.253, TLS: read(size=704) failed: Connection reset by peer, session=<4rmpGmhV0oFChKyA> 2026-06-29T19:51:15.309858+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.172.128, lip=192.168.1.253, session=<28PTGmhV4oFChKyA> 2026-06-29T19:51:17.017530+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.172.128, lip=192.168.1.253, session=<P9LtGmhV7IFChKyA> ... show less	Brute-Force
🇫🇷 Little Iguana	2026-06-29 17:31:25 (6 hours ago)	trying to access non-authorized port	Port Scan
🇨🇳 WMK965	2026-06-29 16:48:54 (7 hours ago)	66.132.172.128 - - [30/Jun/2026:00:48:30 +0800] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xA3\x1 ... show more 66.132.172.128 - - [30/Jun/2026:00:48:30 +0800] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xA3\x16\x83L\x08\xACp\x0F\x15\xBD6\x88\x85\x82\x84S\xAA3\x82\xB1\xBA\x06\x09\xF5\x84\xB2X\xCE\xBC\xBF\x8C E\xEA\xAC\xCF\xCB\xF7\xC9\xA0\xF4\xFD\x10\x15\x7F\xF2V\xF1\x17`\xE3ej\xBC\x82\xDE\x97\xDC\x8C!~\xBC\x93\xF0\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 154 "-" "-" "-" 66.132.172.128 - - [30/Jun/2026:00:48:48 +0800] "GET /wiki HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "-" 66.132.172.128 - - [30/Jun/2026:00:48:52 +0800] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xCD\xF4\xC2f\xC7\x8D3\x05\x22\xCDhFZ\xAD\x9F\xBCV>\xE0\xCF\x09\xD9\xE7" 400 154 "-" "-" "-" show less	Port Scan Web App Attack

Showing 1 to 15 of 3367 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 134.122.122.202

🇻🇳 103.109.31.142

🇩🇪 165.245.209.221

🇰🇷 123.58.200.120

🇻🇳 123.25.115.189

🇨🇳 113.9.119.196

🇮🇳 103.248.120.6

🇬🇧 57.128.182.5

🇵🇱 54.38.52.18

🇫🇷 2001:41d0:33d:9200::40a

🇩🇪 162.19.243.145

🇺🇸 148.153.245.161

🇹🇼 125.229.71.134

🇨🇳 119.167.206.194

🇨🇳 111.27.197.40

🇩🇪 83.143.245.51

🇨🇳 60.162.168.224

🇹🇼 2.58.241.68

🇨🇳 203.56.198.45

🇹🇼 198.235.24.112