JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.56.86.20

66.56.86.20 was found in our database!

This IP was reported 163 times. Confidence of Abuse is 20%: ?

20%

ISP	VPN Consumer Bratislava, Slovakia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇸🇰 Slovakia
City	Bratislava, Bratislava Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.56.86.20

Whois 66.56.86.20

IP Abuse Reports for 66.56.86.20:

This IP address has been reported a total of 163 times from 40 distinct sources. 66.56.86.20 was first reported on April 14th 2025, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 Gem	2026-10-09 22:08:01 (2 weeks ago)	Unauthorized web scan.	Web App Attack
🇮🇹 VHosting	2026-10-05 01:20:03 (3 weeks ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇳🇱 Alt255	2026-10-05 00:23:00 (3 weeks ago)	[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 66.56.86.20 - - [05/Oct/2026:02:22:46 +0200] "GET /wp-content/plugins/buddypress/alfa.php HTTP/1.1" 403 149 "-" "Go-http-client/1.1" ... show less	Bad Web Bot Web App Attack
🇨🇳 鹏鹏	2026-09-07 20:06:12 (1 month ago)	monitor: on VM-0-7-ubuntu \| port: 49078 \| ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporte ... show more monitor: on VM-0-7-ubuntu \| port: 49078 \| ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-03-15 08:25:47 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 15 04:25:41.202473 2026] [security2:error] [pid 23867:tid 23867] [client 66.56.86.20:51855] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ilandman.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ilandman.com"] [uri "/backups/wallet.dat"] [unique_id "abZtBVbgPtfrQQddXrIwegAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 Valhalla	2026-03-14 21:18:19 (7 months ago)	/old/directory.zip	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-03-13 11:00:21 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 13 07:00:16.820032 2026] [security2:error] [pid 12916:tid 12916] [client 66.56.86.20:59259] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "matteozacchino.dev"] [uri "/backups/sftp-config.json"] [unique_id "abPuQJKxYAuyGfZdtYHRQwAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-12 16:57:10 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 12 12:57:03.566755 2026] [security2:error] [pid 1607:tid 1607] [client 66.56.86.20:52577] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.dudleyanddudley.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dudleyanddudley.com"] [uri "/bak/mysql.sql"] [unique_id "abLwX45XhCEaWY7XExJuZAAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Penny Packer	2026-03-08 22:00:09 (7 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇵🇾 armandosaucedo.me	2026-03-01 14:38:40 (7 months ago)	66.56.86.20 - - [01/Mar/2026:14:38:29 +0000] "GET /back/directory.zip HTTP/1.1" 404 196 "-" "-"	Web App Attack
🇩🇪 BlueWire Hosting	2026-02-19 09:24:55 (8 months ago)	Suspicious HTTP(s) activity without a user agent provided	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-16 14:27:50 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 16 09:27:46.899380 2026] [security2:error] [pid 1762195:tid 1762195] [client 66.56.86.20:41979] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yakski.com"] [uri "/bak/sftp-config.json"] [unique_id "aZMpYiC_DtQnqYCphdqilgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Penny Packer	2026-02-15 03:20:27 (8 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇬🇧 pinguin	2026-02-10 23:54:13 (8 months ago)	Triggered Cloudflare WAF (firewallManaged) from SK. Action taken: BLOCK Protocol: HTTP/2 (HEAD metho ... show more Triggered Cloudflare WAF (firewallManaged) from SK. Action taken: BLOCK Protocol: HTTP/2 (HEAD method) Endpoint: /backups/sftp-config.json UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-09 05:09:53 (8 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 00:09:48.741785 2026] [security2:error] [pid 25693:tid 25693] [client 66.56.86.20:32809] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|phantomkennels.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "phantomkennels.com"] [uri "/backups/backup.sql"] [unique_id "aYlsHPY0zbLRUBabPEYx9QAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 163 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.218.206.66

🇦🇪 176.204.116.247

🇺🇸 162.216.150.35

🇸🇬 146.190.98.150

🇨🇳 123.180.188.162

🇳🇱 93.123.109.164

🇩🇪 87.106.25.4

🇧🇬 84.238.218.123

🇮🇹 79.23.109.23

🇺🇸 66.132.186.172

🇫🇷 46.105.28.181

🇳🇱 204.76.203.213

🇧🇷 200.159.14.187

🇳🇱 200.138.46.193

🇪🇨 186.47.77.39

🇩🇪 151.243.11.202

🇺🇸 128.173.237.165

🇫🇮 128.1.198.78

🇨🇳 115.191.40.49

🇳🇱 77.67.26.93