JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.56.85.5

66.56.85.5 was found in our database!

This IP was reported 144 times. Confidence of Abuse is 24%: ?

24%

ISP	VPN Consumer Sofia, Bulgaria
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇧🇬 Bulgaria
City	Sofia, Sofia-Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.56.85.5

Whois 66.56.85.5

IP Abuse Reports for 66.56.85.5:

This IP address has been reported a total of 144 times from 66 distinct sources. 66.56.85.5 was first reported on April 5th 2025, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 BlueWire Hosting	2026-10-16 23:53:48 (5 days ago)	Bad bot ignoring robot.txt	Bad Web Bot
🇩🇪 auridh	2026-10-16 22:59:33 (5 days ago)	Ip 66.56.85.5 performed 'crowdsecurity/http-probing' (11 events over 6.25011284s) at 2026-10-16 22:5 ... show more Ip 66.56.85.5 performed 'crowdsecurity/http-probing' (11 events over 6.25011284s) at 2026-10-16 22:59:33.371052892 +0000 UTC Ip 66.56.85.5 performed 'crowdsecurity/http-wordpress-scan' (4 events over 2.000697892s) at 2026-10-16 22:59:29.121540166 +0000 UTC show less	Web App Attack
🇨🇭 Spam Safe	2026-09-30 22:52:00 (3 weeks ago)	Origin of money laundering scam	Spoofing Email Spam Phishing
Anonymous	2026-09-19 14:03:09 (1 month ago)	[PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [Xm ... show more [PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [XmlRpc] XML-RPC abuse detected: XML-RPC endpoint probe (GET) show less	Port Scan Hacking Brute-Force Web App Attack
🇮🇹 VHosting	2026-09-06 05:20:04 (1 month ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇯🇵 Valhalla	2026-03-16 03:23:46 (7 months ago)	/restore/directory.zip	Hacking Web App Attack
🇵🇾 armandosaucedo.me	2026-03-11 22:36:57 (7 months ago)	66.56.85.5 - - [11/Mar/2026:22:36:52 +0000] "HEAD /backup/www.sql HTTP/1.1" 403 - "-" "-"	Web App Attack
🇺🇸 TPI-Abuse	2026-03-09 05:37:59 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 09 01:37:56.256824 2026] [security2:error] [pid 4897:tid 4897] [client 66.56.85.5:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|eddysgroup.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eddysgroup.com"] [uri "/bak/backup.sql"] [unique_id "aa5ctJ54SbGK41Gp4oQsXwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BlueWire Hosting	2026-03-03 04:12:44 (7 months ago)	Suspicious HTTP(s) activity without a user agent provided	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-03 01:43:53 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 66.56.85.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 02 20:43:50.046233 2026] [security2:error] [pid 22251:tid 22251] [client 66.56.85.5:39493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bitcoinsquaretrader.com"] [uri "/backup/sftp-config.json"] [unique_id "aaY81mK00MCGHWlE-ysrowAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-03-02 05:28:53 (7 months ago)	Blocked by UFW (TCP on 51413) Source port: 24860 TTL: 49 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 51413) Source port: 24860 TTL: 49 Packet length: 60 TOS: 0x00 This report (for 66.56.85.5) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇨🇿 unhfree.net	2026-03-01 19:58:42 (7 months ago)	Mar 1 20:30:46 canopus postfix/smtpd[1536994]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 ... show more Mar 1 20:30:46 canopus postfix/smtpd[1536994]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOP-27R1F0T.Home> Mar 1 20:30:46 canopus postfix/smtpd[1536994]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOP-27R1F0T.Home> Mar 1 20:54:29 canopus postfix/smtpd[1538541]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<DESKTOP-27R1F0T.Home> Mar 1 20:54:29 canopus postfix/smtpd[1538541]: NOQUEUE: reject: RCPT from unknown[66.56.85.5]: 554 5.7.1 <[email protected]>: Sender address rejected: Access denied; from=<sendmail@unhf ... show less	Brute-Force Exploited Host
🇺🇸 vandomatos	2026-03-01 18:36:23 (7 months ago)	Mar 1 10:36:06 servidor postfix/submission/smtpd[2477355]: warning: unknown[66.56.85.5]: SASL PLAIN ... show more Mar 1 10:36:06 servidor postfix/submission/smtpd[2477355]: warning: unknown[66.56.85.5]: SASL PLAIN authentication failed: Mar 1 10:36:12 servidor postfix/submission/smtpd[2477355]: warning: unknown[66.56.85.5]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 1 10:36:21 servidor postfix/smtps/smtpd[2480014]: warning: unknown[66.56.85.5]: SASL PLAIN authentication failed: ... show less	Phishing Web Spam Email Spam Hacking Spoofing Brute-Force Bad Web Bot
🇬🇧 Axel	2026-02-25 11:40:03 (7 months ago)	Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /old/sftp-con ... show more Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /old/sftp-config.json Server: UK-01 show less	Web App Attack Hacking SQL Injection
🇱🇹 kermit	2026-02-22 15:21:07 (7 months ago)	RdpGuard detected brute-force attempt on RDP	Brute-Force

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 176.152.238.107

🇮🇹 158.47.215.1

🇦🇺 118.127.105.182

🇺🇸 100.49.117.77

🇧🇬 79.124.58.90

🇳🇱 204.76.203.7

🇺🇸 195.184.76.187

🇺🇾 179.27.98.8

🇩🇪 104.140.188.46

🇫🇷 88.169.149.193

🇬🇧 81.19.219.224

🇩🇪 69.5.169.253

🇩🇪 68.183.79.225

🇺🇸 64.62.156.33

🇳🇱 204.76.203.222

🇳🇱 204.76.203.221

🇳🇱 195.178.110.30

🇳🇱 193.47.62.69

🇫🇷 185.177.72.66

🇭🇰 152.32.209.108