JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

66.132.195.181

Recent Activity

Abuse confidence score ?

100% Critical

55 reports

47 reporters · latest 3 hours ago

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Hostname(s)	181.195.132.66.censys-scanner.com
Domain Name	censys.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 66.132.195.181

Export CSV

This IP address has been reported a total of 55 times from 47 distinct sources. 66.132.195.181 was first reported on October 7th 2026, and the most recent report was 3 hours ago. In the last 60 days, the top reporter locations were: United States of America with 12 reports; France with 10 reports; Germany with 9 reports. The most common categories in these recent reports were: Port Scan 32 times; Brute-Force 14 times; SSH 10 times; Hacking 10 times; Web App Attack 8 times; Other 10 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 hxsain	2026-10-11 16:27:06 (3 hours ago)	Blocked by UFW on fr2 [30093/tcp] \| SPT: 50668 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github ... show more Blocked by UFW on fr2 [30093/tcp] \| SPT: 50668 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇱 donarev419	2026-10-11 09:53:53 (9 hours ago)	Port scan detected on port 2 (connection without data transfer)	Port Scan
🇫🇷 fzc2000	2026-10-11 09:30:10 (10 hours ago)	Repeated TCP connections to unused ports on a honeypot	Port Scan
🇫🇷 EvoX	2026-10-11 08:10:35 (11 hours ago)	🛡️ Honeypot [bsts-tpot-sensor]: Empty payload (likely service probe); 4579 [3] TCP	Port Scan
🇯🇵 S.O.B.A. Dev.	2026-10-11 03:44:42 (15 hours ago)	Persistent port scanning or vulnerability scanning	Port Scan
🇧🇷 diego	2026-10-11 01:44:00 (17 hours ago)	[probe-44-49] 2026-10-11 01:25:06, Client: 66.132.195.181, Protocol: 6, Unauthorized activity to HTT ... show more [probe-44-49] 2026-10-11 01:25:06, Client: 66.132.195.181, Protocol: 6, Unauthorized activity to HTTP: GET / show less	Web App Attack
🇫🇷 sthoyer.de	2026-10-11 00:40:34 (18 hours ago)	Oct 11 02:40:23 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd: ... show more Oct 11 02:40:23 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=66.132.195.181 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=62061 DF PROTO=TCP SPT=35892 DPT=25565 WINDOW=21900 RES=0x00 SYN URGP=0 Oct 11 02:40:24 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=66.132.195.181 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=62062 DF PROTO=TCP SPT=35892 DPT=25565 WINDOW=21900 RES=0x00 SYN URGP=0 Oct 11 02:40:26 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=66.132.195.181 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=62063 DF PROTO=TCP SPT=35892 DPT=25565 WINDOW=21900 RES=0x00 SYN URGP=0 Oct 11 02:40:30 sthoyer kernel: [IPTables-Dropped-I] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=66.132.195.181 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=62064 DF PROTO=TCP SPT=35892 DPT=2556 ... show less	Port Scan
Anonymous	2026-10-11 00:00:57 (19 hours ago)	apache vulnerability scan	Web App Attack
🇩🇪 Nick2	2026-10-10 23:06:11 (20 hours ago)	2026-10-10 23:06:07 connection from 66.132.195.181 2026-10-10 23:06:10 connection from 66.132.195.18 ... show more 2026-10-10 23:06:07 connection from 66.132.195.181 2026-10-10 23:06:10 connection from 66.132.195.181 2026-10-10 23:06:10 connection from 66.132.195.181 2026-10-10 23:06:11 connection from 66.132.195.181 2026-10-10 23:06:11 connection from 66.132.195.181 ... show less	Brute-Force Port Scan SSH
🇬🇧 BananaLlama	2026-10-10 22:42:38 (20 hours ago)	Unsolicited SSH (TCP/22) connection attempts blocked at edge firewall; no public SSH service is expo ... show more Unsolicited SSH (TCP/22) connection attempts blocked at edge firewall; no public SSH service is exposed. show less	Port Scan SSH
🇺🇸 drewf.ink	2026-10-10 21:48:31 (21 hours ago)	[21:48] Probed the WinRM endpoint (unauthenticated, no credentials offered)	Brute-Force Hacking
🇨🇦 Daniel Gomez	2026-10-10 20:16:53 (23 hours ago)	Oct 10 13:16:46 smtp.dgsmailer.cc dovecot[9610]: imap-login: Login aborted: Connection closed: SSL_a ... show more Oct 10 13:16:46 smtp.dgsmailer.cc dovecot[9610]: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A000102:SSL routines::unsupported protocol (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=66.132.195.181, lip=149.248.54.134, TLS handshaking: SSL_accept() failed: error:0A000102:SSL routines::unsupported protocol, session=<5Q/aJIJdMuVChMO1> Oct 10 13:16:49 smtp.dgsmailer.cc dovecot[9610]: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A000102:SSL routines::unsupported protocol (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=66.132.195.181, lip=149.248.54.134, TLS handshaking: SSL_accept() failed: error:0A000102:SSL routines::unsupported protocol, session=<pyD1JIJdSOVChMO1> Oct 10 13:16:53 smtp.dgsmailer.cc dovecot[9610]: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A000102:SSL routines::unsupported protocol (disconnected during TLS handshake) (tls ... show less	Brute-Force Email Spam
🇬🇧 spufidoo	2026-10-10 20:06:23 (23 hours ago)	2026-10-10T21:06:19.904203+01:00 heimdall kernel: [12724388.871495] [UFW BLOCK] IN=eth0 OUT= MAC=b8: ... show more 2026-10-10T21:06:19.904203+01:00 heimdall kernel: [12724388.871495] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:03:7e:40:00:39:06:73:0f SRC=66.132.195.181 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=894 DF PROTO=TCP SPT=54502 DPT=22 WINDOW=21900 RES=0x00 SYN URGP=0 2026-10-10T21:06:20.927642+01:00 heimdall kernel: [12724389.894851] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:03:7f:40:00:39:06:73:0e SRC=66.132.195.181 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=895 DF PROTO=TCP SPT=54502 DPT=22 WINDOW=21900 RES=0x00 SYN URGP=0 2026-10-10T21:06:21.169852+01:00 heimdall kernel: [12724390.137068] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:11:0e:40:00:39:06:65:7f SRC=66.132.195.181 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=4366 DF PROTO=TCP SPT=54530 DPT=22 WINDOW=21900 RES=0x00 SYN URGP=0 ... show less	Brute-Force SSH
🇫🇮 JLKnoch Software GmbH	2026-10-10 17:04:31 (1 day ago)	CrowdSec crowdsecurity/http-bad-user-agent	Brute-Force Web App Attack
🇺🇸 uhhhhhhyeahnotanythingthatislikemyotheraccountsanywhereelse	2026-10-10 16:17:11 (1 day ago)	6 login or exploit attempts on SSH/22, 2026-10-10 16:01-16:01 UTC	Brute-Force SSH

Showing 1 to 15 of 55 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.182

🇦🇷 179.38.182.243

🇺🇸 172.200.195.165

🇫🇷 91.231.89.62

🇬🇧 77.67.26.97

🇯🇵 8.216.10.202

🇰🇷 220.126.8.143

🇹🇼 198.235.24.94

🇧🇴 190.181.25.210

🇩🇪 162.19.214.165

🇨🇦 158.69.117.45

🇹🇼 59.126.194.111

🇺🇸 20.163.169.57

🇰🇷 211.43.1.106

🇿🇦 197.185.254.169

🇺🇸 154.201.89.198

🇫🇷 137.74.114.131

🇩🇪 128.1.42.111

🇺🇸 192.210.206.233

🇳🇱 185.242.226.93