JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.132.224.223

66.132.224.223 was found in our database!

This IP was reported 1,693 times. Confidence of Abuse is 100%: ?

100%

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Hostname(s)	223.224.132.66.censys-scanner.com
Domain Name	censys.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.132.224.223

Whois 66.132.224.223

IP Abuse Reports for 66.132.224.223:

This IP address has been reported a total of 1,693 times from 462 distinct sources. 66.132.224.223 was first reported on March 23rd 2026, and the most recent report was 36 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 notelseit	2026-07-07 14:15:44 (36 minutes ago)	2026-07-07T16:15:28.184578+02:00 mail dovecot: imap-login: Disconnected: Connection closed (no auth ... show more 2026-07-07T16:15:28.184578+02:00 mail dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.224.223, lip=65.21.131.50, TLS: Connection closed, session=<Ak/ZBQZW9ItChODf> 2026-07-07T16:15:35.711404+02:00 mail dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.224.223, lip=65.21.131.50, session=<BSlMBgZWQNVChODf> 2026-07-07T16:15:37.721367+02:00 mail dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.224.223, lip=65.21.131.50, session=<pdRqBgZWSNVChODf> 2026-07-07T16:15:40.065448+02:00 mail dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.224.223, lip=65.21.131.50, session=<DpmOBgZWTNVChODf> 2026-07-07T16:15:43.851328+02:00 mail dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts in 2 secs): user=<>, rip=66.132.224.223, lip=65.21.131. ... show less	Brute-Force Email Spam
🇨🇭 4server	2026-07-07 11:51:23 (3 hours ago)	[TueJul0713:51:19.1962282026][security2:error][pid3836688:tid3836861][client66.132.224.223:0]ModSecu ... show more [TueJul0713:51:19.1962282026][security2:error][pid3836688:tid3836861][client66.132.224.223:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"salonesamire.ch\"][uri\"/\"][unique_id\"akzoN6sRsmFMyt7kQWorugAAAEI\"] show less	Hacking Web App Attack
🇬🇧 Steve	2026-07-07 11:33:58 (3 hours ago)	Attempts against Pop3/IMAP	Brute-Force
🇺🇸 mnsf	2026-07-07 10:06:37 (4 hours ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇺🇸 itsnixk	2026-07-07 07:32:00 (7 hours ago)	(mod_security) mod_security (id:920350) triggered by 66.132.224.223 (US/United States/223.224.132.66 ... show more (mod_security) mod_security (id:920350) triggered by 66.132.224.223 (US/United States/223.224.132.66.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 07 03:31:55.013055 2026] [security2:error] [pid 1429654:tid 1430105] [client 66.132.224.223:22584] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.26.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "akyra_ZSX2qGRsWYU04saQAAAQY"] show less	Port Scan
🇺🇸 gu-alvareza	2026-07-07 07:05:33 (7 hours ago)	Censys.io.Scanner	Port Scan
🇩🇪 dispaisyenterprises	2026-07-07 06:40:51 (8 hours ago)	Honeypot [fra-de-honeypot]: Unauthorized traffic (8 bytes of payload); 10000 [4] TCP Reported by Dis ... show more Honeypot [fra-de-honeypot]: Unauthorized traffic (8 bytes of payload); 10000 [4] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇦🇺 LiftUp Hosting	2026-07-07 05:57:58 (8 hours ago)	Honeypot hit: Empty payload (likely service probe); 48101 [3] TCP	Port Scan
🇫🇷 Entalpi.net	2026-07-07 04:54:02 (9 hours ago)	Repeated requests against sensitive web endpoints	Web App Attack
🇦🇺 afleventoffice.com.au	2026-07-07 03:28:54 (11 hours ago)	\x16\x03\x01\x01\n	Web App Attack
🇧🇷 ludarkstar99	2026-07-07 02:55:05 (11 hours ago)	Blocked by os-abuseipdb; 10 hits, proto=tcp, ports=5006	Port Scan Hacking
🇨🇦 dpinse	2026-07-07 02:35:39 (12 hours ago)	Honeypot [honeypot-ca-sensor1]: Unauthorized connection attempt detected on 22/SSH • Client: SSH-2.0 ... show more Honeypot [honeypot-ca-sensor1]: Unauthorized connection attempt detected on 22/SSH • Client: SSH-2.0-Go show less	SSH Port Scan
🇩🇪 Nerdscave Hosting	2026-07-06 23:32:05 (15 hours ago)	[SMB Honeypot Report] Timestamp: 2026-07-06 23:31:33 UTC Port: 7082 Attempted credentials (Base64): ... show more [SMB Honeypot Report] Timestamp: 2026-07-06 23:31:33 UTC Port: 7082 Attempted credentials (Base64): alNNQkB8AXwkfAN8AXwQAnwDAgM= Attack Type: Unauthorized SMB connection attempt show less	Brute-Force Port Scan Hacking
🇫🇷 masterguru	2026-07-06 23:14:12 (15 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 66.132.224.223 (US/United States/223. ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 66.132.224.223 (US/United States/223.224.132.66.censys-scanner.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇨🇦 Luhte	2026-07-06 22:51:13 (16 hours ago)	Unsolicited TCP connection from 66.132.224.223 to port 0 at 2026-07-06T22:51:13Z. Source IP complete ... show more Unsolicited TCP connection from 66.132.224.223 to port 0 at 2026-07-06T22:51:13Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring. show less	Port Scan Hacking

Showing 1 to 15 of 1693 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 223.194.21.240

🇰🇷 220.94.238.133

🇺🇸 216.25.89.127

🇩🇪 69.5.169.44

🇳🇱 188.166.99.91

🇨🇳 171.217.92.33

🇫🇷 91.196.152.206

🇫🇷 91.196.152.19

🇫🇷 85.69.240.210

🇳🇱 83.168.106.26

🇺🇸 44.196.202.29

🇬🇧 35.203.210.80

🇺🇸 34.125.203.250

🇺🇸 34.75.194.129

🇪🇹 196.188.187.85

🇦🇴 193.163.125.58

🇬🇧 178.128.32.203

🇨🇳 175.30.48.134

🇨🇳 123.233.235.238

🇨🇴 108.174.156.122