JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.132.195.103

66.132.195.103 was found in our database!

This IP was reported 2,093 times. Confidence of Abuse is 100%: ?

100%

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Hostname(s)	103.195.132.66.censys-scanner.com
Domain Name	censys.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.132.195.103

Whois 66.132.195.103

IP Abuse Reports for 66.132.195.103:

This IP address has been reported a total of 2,093 times from 494 distinct sources. 66.132.195.103 was first reported on March 23rd 2026, and the most recent report was 11 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Admins@FBN	2026-07-07 11:23:34 (11 minutes ago)	FW-PortScan: Traffic Blocked srcport=22510 dstport=6556	Port Scan
🇧🇷 SSP	2026-07-07 09:05:04 (2 hours ago)	Automatically generated from firewall_v2 logs on SID:VTSP4 Category: Port Scan Occurrences: 28 Un ... show more Automatically generated from firewall_v2 logs on SID:VTSP4 Category: Port Scan Occurrences: 28 Unique Ports: 8 Destination Ports: 8001, 6082, 4082, 8003, 2022, 6083, 8030, 31210 First Seen: 2026-07-07 08:05 UTC Last Seen: 2026-07-07 08:05 UTC show less	Port Scan
🇺🇸 MPL	2026-07-07 08:46:56 (2 hours ago)	tcp/51443 (3 or more attempts)	Port Scan
🇭🇰 sammy4101	2026-07-07 06:35:07 (5 hours ago)	Fail2ban: Web scanner. Exceeded 10 web vulnerability scan attempts within 58 seconds from 66.132.195 ... show more Fail2ban: Web scanner. Exceeded 10 web vulnerability scan attempts within 58 seconds from 66.132.195.103. show less	Hacking Web App Attack
🇩🇰 swrlly	2026-07-07 06:03:31 (5 hours ago)	1 unauthorized webserver connection	Web App Attack
🇺🇸 antlac1	2026-07-07 03:19:38 (8 hours ago)	crowdsecurity/http-bad-user-agent	Brute-Force Web App Attack
🇳🇱 Eric	2026-07-07 01:25:15 (10 hours ago)	[Tue Jul 07 01:25:05.503736 2026] [security2:error] [pid 1554747:tid 1554747] [client 66.132.195.103 ... show more [Tue Jul 07 01:25:05.503736 2026] [security2:error] [pid 1554747:tid 1554747] [client 66.132.195.103:47728] [client 66.132.195.103] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "736"] [id "920350"] [msg "Host header is a numeric IP address"] [data "94.209.38.171"] [severity "WARNING"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "94.209.38.171"] [uri "/"] [unique_id "akxVcXD6d6EaOuMgSgJ5xQAAAA0"] [Tue Jul 07 01:25:06.244490 2026] [security2:error] [pid 1570158:tid 1570158] [client 66.132.195.103:47744] [client 66.132.195.103] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "736"] [id "920 ... show less	Hacking Web App Attack
🇸🇬 anotherwatcher	2026-07-06 23:55:53 (11 hours ago)	bad bot	Bad Web Bot
🇩🇪 kreativstrecke	2026-07-06 23:49:00 (11 hours ago)	2026-07-07T01:48:56.562619+02:00 mailtwo postfix/smtps/smtpd[1224036]: lost connection after EHLO fr ... show more 2026-07-07T01:48:56.562619+02:00 mailtwo postfix/smtps/smtpd[1224036]: lost connection after EHLO from 103.195.132.66.censys-scanner.com[66.132.195.103] 2026-07-07T01:48:57.999527+02:00 mailtwo postfix/smtps/smtpd[1224036]: lost connection after CONNECT from 103.195.132.66.censys-scanner.com[66.132.195.103] 2026-07-07T01:48:59.403450+02:00 mailtwo postfix/smtps/smtpd[1224036]: lost connection after CONNECT from 103.195.132.66.censys-scanner.com[66.132.195.103] ... show less	Brute-Force
🇺🇸 mccsoft.io	2026-07-06 22:33:35 (13 hours ago)	Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). So ... show more Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). Source matched a blocked-path security rule (jail nginx-444); server returned HTTP 444 (connection closed without response). TCP three-way handshake completed (full HTTP request received). show less	Bad Web Bot Web App Attack
🇬🇧 gbzret4d	2026-07-06 22:03:55 (13 hours ago)	Honeypot [uk-production01]: Empty payload (likely service probe); 8010 [1] TCP	Port Scan
🇮🇩 Konaa	2026-07-06 21:51:12 (13 hours ago)	Jul 07 04:51:00 rapi wings[9131]: ERROR: [Jul 7 04:51:00.968] sftp: failed to accept inbound connect ... show more Jul 07 04:51:00 rapi wings[9131]: ERROR: [Jul 7 04:51:00.968] sftp: failed to accept inbound connection error=EOF ip=66.132.195.103:23324 show less	Brute-Force Port Scan
🇭🇰 mutebot.net	2026-07-06 21:28:37 (14 hours ago)	SRC=66.132.195.103, PROTO=TCP, SPT=14666, DPT=25	Port Scan
🇩🇪 guldkage	2026-07-06 20:58:43 (14 hours ago)	Unauthorized connection attempt detected from IP address 66.132.195.103 to port 3306 (ger-02) [MYSQL ... show more Unauthorized connection attempt detected from IP address 66.132.195.103 to port 3306 (ger-02) [MYSQL] show less	Exploited Host
🇦🇺 2000cn.com.au	2026-07-06 19:16:44 (16 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot

Showing 1 to 15 of 2093 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 193.46.0.233

🇬🇧 193.46.0.224

🇬🇧 193.46.0.223

🇬🇧 193.46.0.86

🇫🇷 85.217.140.29

🇩🇪 51.75.64.35

🇭🇰 47.82.99.25

🇬🇧 35.203.210.127

🇳🇱 34.12.91.80

🇬🇧 193.46.0.218

🇬🇧 193.46.0.217

🇬🇧 193.46.0.123

🇬🇧 193.46.0.55

🇧🇴 190.181.4.12

🇵🇾 190.128.201.18

🇳🇱 176.65.148.158

🇩🇪 69.5.169.228

🇩🇪 5.9.141.76

🇬🇧 193.46.0.245

🇬🇧 193.46.0.204