JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

66.56.85.5

Recent Activity

Abuse confidence score ?

26% Elevated

144 reports

66 reporters · latest 1 day ago

ISP	VPN Consumer Sofia, Bulgaria
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇧🇬 Bulgaria
City	Sofia, Sofia-Capital

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 66.56.85.5

Export CSV

This IP address has been reported a total of 144 times from 66 distinct sources. 66.56.85.5 was first reported on April 5th 2025, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: Germany with 2 reports; Switzerland with 1 report; Italy with 1 report. The most common categories in these recent reports were: Web App Attack 3 times; Brute-Force 2 times; Port Scan 1 time; Email Spam 1 time; Spoofing 1 time; Other 3 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 BlueWire Hosting	2026-10-16 23:53:48 (1 day ago)	Bad bot ignoring robot.txt	Bad Web Bot
🇩🇪 auridh	2026-10-16 22:59:33 (1 day ago)	Ip 66.56.85.5 performed 'crowdsecurity/http-probing' (11 events over 6.25011284s) at 2026-10-16 22:5 ... show more Ip 66.56.85.5 performed 'crowdsecurity/http-probing' (11 events over 6.25011284s) at 2026-10-16 22:59:33.371052892 +0000 UTC Ip 66.56.85.5 performed 'crowdsecurity/http-wordpress-scan' (4 events over 2.000697892s) at 2026-10-16 22:59:29.121540166 +0000 UTC show less	Web App Attack
🇨🇭 Spam Safe	2026-09-30 22:52:00 (2 weeks ago)	Origin of money laundering scam	Spoofing Email Spam Phishing
Anonymous	2026-09-19 14:03:09 (4 weeks ago)	[PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [Xm ... show more [PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [XmlRpc] XML-RPC abuse detected: XML-RPC endpoint probe (GET) show less	Port Scan Hacking Brute-Force Web App Attack
🇮🇹 VHosting	2026-09-06 05:20:04 (1 month ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇯🇵 Valhalla	2026-03-16 03:23:46 (7 months ago)	/restore/directory.zip	Hacking Web App Attack
🇵🇾 armandosaucedo.me	2026-03-11 22:36:57 (7 months ago)	66.56.85.5 - - [11/Mar/2026:22:36:52 +0000] "HEAD /backup/www.sql HTTP/1.1" 403 - "-" "-"	Web App Attack
🇺🇸 TPI-Abuse	2026-03-09 05:37:59 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 09 01:37:56.256824 2026] [security2:error] [pid 4897:tid 4897] [client 66.56.85.5:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|eddysgroup.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eddysgroup.com"] [uri "/bak/backup.sql"] [unique_id "aa5ctJ54SbGK41Gp4oQsXwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BlueWire Hosting	2026-03-03 04:12:44 (7 months ago)	Suspicious HTTP(s) activity without a user agent provided	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-03 01:43:53 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 02 20:43:50.046233 2026] [security2:error] [pid 22251:tid 22251] [client 66.56.85.5:39493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bitcoinsquaretrader.com"] [uri "/backup/sftp-config.json"] [unique_id "aaY81mK00MCGHWlE-ysrowAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-03-02 05:28:53 (7 months ago)	Blocked by UFW (TCP on 51413) Source port: 24860 TTL: 49 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 51413) Source port: 24860 TTL: 49 Packet length: 60 TOS: 0x00 This report (for 66.56.85.5) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇨🇿 unhfree.net	2026-03-01 19:58:42 (7 months ago)	Mar 1 20:30:46 canopus postfix/smtpd[1536994]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 ... show more Mar 1 20:30:46 canopus postfix/smtpd[1536994]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOP-27R1F0T.Home> Mar 1 20:30:46 canopus postfix/smtpd[1536994]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOP-27R1F0T.Home> Mar 1 20:54:29 canopus postfix/smtpd[1538541]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOP-27R1F0T.Home> Mar 1 20:54:29 canopus postfix/smtpd[1538541]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<sendmail@unhf ... show less	Brute-Force Exploited Host
🇺🇸 vandomatos	2026-03-01 18:36:23 (7 months ago)	Mar 1 10:36:06 servidor postfix/submission/smtpd[2477355]: warning: unknown[66.56.85.5]: SASL PLAIN ... show more Mar 1 10:36:06 servidor postfix/submission/smtpd[2477355]: warning: unknown[66.56.85.5]: SASL PLAIN authentication failed: Mar 1 10:36:12 servidor postfix/submission/smtpd[2477355]: warning: unknown[66.56.85.5]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 1 10:36:21 servidor postfix/smtps/smtpd[2480014]: warning: unknown[66.56.85.5]: SASL PLAIN authentication failed: ... show less	Phishing Web Spam Email Spam Hacking Spoofing Brute-Force Bad Web Bot
🇬🇧 Axel	2026-02-25 11:40:03 (7 months ago)	Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /old/sftp-con ... show more Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /old/sftp-config.json Server: UK-01 show less	Web App Attack Hacking SQL Injection
🇱🇹 kermit	2026-02-22 15:21:07 (7 months ago)	RdpGuard detected brute-force attempt on RDP	Brute-Force

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 2a01:4020:2:b:102::30a

🇬🇧 193.32.209.254

🇳🇱 45.148.10.157

🇧🇷 34.151.234.92

🇳🇱 2a01:4020:2:b:101::4ca

🇳🇱 212.92.104.214

🇰🇷 211.239.113.21

🇨🇭 209.99.190.215

🇬🇧 165.232.101.207

🇴🇲 161.8.119.191

🇳🇱 109.160.32.139

🇬🇧 86.38.187.36

🇺🇸 45.45.237.97

🇳🇱 195.178.110.30

🇪🇨 181.199.42.53

🇺🇸 172.172.186.3

🇲🇼 41.190.94.37

🇩🇪 185.73.23.161

🇸🇦 176.224.189.124

🇺🇸 136.107.174.13