JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.132.172.188

66.132.172.188 was found in our database!

This IP was reported 2,694 times. Confidence of Abuse is 100%: ?

100%

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Hostname(s)	188.172.132.66.censys-scanner.com
Domain Name	censys.io
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.132.172.188

Whois 66.132.172.188

IP Abuse Reports for 66.132.172.188:

This IP address has been reported a total of 2,694 times from 513 distinct sources. 66.132.172.188 was first reported on March 20th 2026, and the most recent report was 4 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 diego	2026-07-01 11:05:20 (4 minutes ago)	[probe-44-49] 2026-07-01 10:46:59, Client: 66.132.172.188, Protocol: 6, Unauthorized activity to HTT ... show more [probe-44-49] 2026-07-01 10:46:59, Client: 66.132.172.188, Protocol: 6, Unauthorized activity to HTTP: GET /a9fdu441vqfi00hrjs show less	Web App Attack
Anonymous	2026-07-01 09:52:23 (1 hour ago)	Reported from Nginx log analysis 16. Log: 66.132.172.188 - - [01/Jul/2026:xx:xx:xx 0200] "GET / HTT ... show more Reported from Nginx log analysis 16. Log: 66.132.172.188 - - [01/Jul/2026:xx:xx:xx 0200] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; https://about.censys.io/)" "-" "US United States -" "AS398324" "Censys, Inc." show less	Port Scan Brute-Force SSH
🇩🇪 dispaisyenterprises	2026-07-01 09:33:49 (1 hour ago)	Honeypot [fra-de-honeypot]: Empty payload (likely service probe); 2005 [1] TCP Reported by DisPaisy ... show more Honeypot [fra-de-honeypot]: Empty payload (likely service probe); 2005 [1] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇲🇹 neilcaruana	2026-07-01 08:08:07 (3 hours ago)	Sentinel detected an attack on port [2443]	Hacking
🇺🇸 mccsoft.io	2026-07-01 07:59:48 (3 hours ago)	Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). So ... show more Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). Source matched a blocked-path security rule (jail nginx-444); server returned HTTP 444 (connection closed without response). TCP three-way handshake completed (full HTTP request received). show less	Bad Web Bot Web App Attack
🇸🇬 drewf.ink	2026-07-01 07:53:19 (3 hours ago)	[07:53] Port scanning. Port(s) scanned: TCP/636	Port Scan
🇩🇪 ITSNF	2026-07-01 07:20:03 (3 hours ago)	Blocked by os-abuseipdb; 8 hits, proto=tcp, ports=443	Port Scan Hacking
🇩🇪 ValtonTahiri	2026-07-01 06:41:11 (4 hours ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=66.132.172.188; proto=TCP; source_port=16300; target_port=4240; flags=SYN show less	Port Scan
🇨🇦 celestialcity	2026-07-01 05:45:33 (5 hours ago)	Blocked by UFW on celestialcityna [6071/tcp] \| SPT: 32368 \| TTL: 50 \| LEN: 60 \| TOS: 0x00 • Reported ... show more Blocked by UFW on celestialcityna [6071/tcp] \| SPT: 32368 \| TTL: 50 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Robbie	2026-07-01 04:31:51 (6 hours ago)	Jul 1 04:31:50 Ubuntu-2204-jammy-amd64-base sshd[1118342]: Connection closed by 66.132.172.188 port ... show more Jul 1 04:31:50 Ubuntu-2204-jammy-amd64-base sshd[1118342]: Connection closed by 66.132.172.188 port 61364 [preauth] ... show less	Brute-Force SSH
🇺🇸 itsnixk	2026-07-01 03:54:17 (7 hours ago)	(mod_security) mod_security (id:920350) triggered by 66.132.172.188 (US/United States/188.172.132.66 ... show more (mod_security) mod_security (id:920350) triggered by 66.132.172.188 (US/United States/188.172.132.66.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jun 30 23:54:12.339326 2026] [security2:error] [pid 1133977:tid 1134561] [client 66.132.172.188:48984] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.26.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "akSPZEIesF0il1uIEeiqFQAAAOc"] show less	Port Scan
🇺🇸 donarev419	2026-07-01 03:27:18 (7 hours ago)	Port scan detected on port 5556 (connection without data transfer)	Port Scan
🇬🇧 gbzret4d	2026-07-01 03:03:50 (8 hours ago)	Honeypot [uk-production01]: Empty payload (likely service probe); 27740 [1] TCP	Port Scan
🇳🇱 donarev419	2026-07-01 02:18:33 (8 hours ago)	Connection to port 6443 with data transfer. Data preview:	Port Scan Hacking
🇩🇪 Luhte	2026-07-01 01:31:33 (9 hours ago)	Unsolicited TCP connection from 66.132.172.188 to port 0 at 2026-07-01T01:31:33Z. Source IP complete ... show more Unsolicited TCP connection from 66.132.172.188 to port 0 at 2026-07-01T01:31:33Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring. show less	Port Scan Hacking

Showing 1 to 15 of 2694 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 187.45.95.66

🇨🇴 181.128.56.158

🇳🇱 45.148.10.166

🇺🇸 13.86.104.104

🇷🇺 2a09:bac1:61e0::80:192

🇬🇧 193.163.125.247

🇺🇦 185.68.18.52

🇲🇾 121.120.42.31

🇫🇷 91.231.89.228

🇮🇷 85.198.21.237

🇨🇳 222.71.122.90

🇲🇾 203.121.40.210

🇬🇧 195.206.182.217

🇲🇽 187.141.71.166

🇨🇳 183.221.243.24

🇷🇺 176.118.22.128

🇳🇱 176.65.131.188

🇺🇸 172.191.157.64

🇫🇷 158.220.111.161

🇷🇴 80.94.92.145