JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 66.56.86.251

66.56.86.251 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 0%: ?

ISP	VPN Consumer Bratislava, Slovakia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇸🇰 Slovakia
City	Bratislava, Bratislava Region

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 66.56.86.251

Whois 66.56.86.251

IP Abuse Reports for 66.56.86.251:

This IP address has been reported a total of 29 times from 8 distinct sources. 66.56.86.251 was first reported on October 13th 2025, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 r3versedk	2026-03-15 19:13:51 (4 months ago)	🛡️ Automated Threat Report from maxjensen.dk 🎯 Attack Type: Botnet Fingerprint 🚨 Severity: CRITICAL ... show more 🛡️ Automated Threat Report from maxjensen.dk 🎯 Attack Type: Botnet Fingerprint 🚨 Severity: CRITICAL 📊 Threat Score: 95/100 📈 Total Attacks: 407 (database verified, seen over today) 🔍 Peak Score: 95/100 🎯 Common Types: Botnet Fingerprint(1x) 🔍 Fingerprint: 9f96b00ce11bc787 🤖 AI/ML: 🤝 Multi-Model Consensus (neural-network, q-learning, gpt) - 🧠 NN (55%): block (95.9%) \| 🎮 QL (23%): allow (75.0%) \| 🤖 GPT (23%): monitor (70.0%) \| ⚖️ dynamic+boosted weights... Detected: 2026-03-15T19:13:51.449Z show less	Bad Web Bot
🇺🇸 Penny Packer	2026-03-15 12:26:53 (4 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇺🇸 TPI-Abuse	2026-03-12 07:12:20 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 12 03:12:14.387166 2026] [security2:error] [pid 11530:tid 11557] [client 66.56.86.251:24531] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|peapage.productions\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "peapage.productions"] [uri "/www.sql"] [unique_id "abJnTnqYzPGlxhpfJqrxmQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Penny Packer	2026-02-28 11:55:34 (4 months ago)	Fail2Ban apache-tripwires	Web App Attack
🇺🇸 TPI-Abuse	2026-02-25 20:03:25 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 15:03:18.951290 2026] [security2:error] [pid 8387:tid 8387] [client 66.56.86.251:31743] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bitcoinsquaretrader.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bitcoinsquaretrader.com"] [uri "/bak/wallet.dat"] [unique_id "aZ9Vho2WG39KOerhFp2YiAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-18 09:28:06 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 18 04:27:59.815078 2026] [security2:error] [pid 20591:tid 20591] [client 66.56.86.251:29147] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mpaexchangeinc.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mpaexchangeinc.com"] [uri "/old/dump.sql"] [unique_id "aZWGH5Lf56eYy-lT6UrY1gAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Axel	2026-02-15 10:22:46 (5 months ago)	Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /back/sftp-co ... show more Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /back/sftp-config.json show less	Hacking SQL Injection Web App Attack
🇬🇧 pinguin	2026-02-14 01:15:22 (5 months ago)	Triggered Cloudflare WAF (firewallManaged) from SK. Action taken: LOG Protocol: HTTP/2 (HEAD method) ... show more Triggered Cloudflare WAF (firewallManaged) from SK. Action taken: LOG Protocol: HTTP/2 (HEAD method) Endpoint: /backup/public_html.tar UA: Empty string This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇯🇵 Valhalla	2026-02-09 07:56:10 (5 months ago)	/backup/application.zip	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-01-26 18:45:24 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 13:45:19.612700 2026] [security2:error] [pid 4793:tid 4793] [client 66.56.86.251:61607] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|lusocleaningservice.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lusocleaningservice.com"] [uri "/sql.sql"] [unique_id "aXe2P18TDzEivNeWUxCq9QAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 bescared	2026-01-06 08:14:32 (6 months ago)	F2B - Malicious activity detected. URL Probing.	Hacking Bad Web Bot Web App Attack
🇯🇵 Valhalla	2025-12-29 08:49:39 (6 months ago)	/back/directory.tar.gz	Hacking Web App Attack
🇩🇪 bescared	2025-12-26 08:49:43 (6 months ago)	F2B - Malicious activity detected. URL Probing.	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-26 08:47:14 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 26 03:47:10.447512 2025] [security2:error] [pid 7361:tid 7361] [client 66.56.86.251:38839] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cryptofructo.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cryptofructo.com"] [uri "/back/dump.sql"] [unique_id "aU5LjgR7eKrkG46xOWyJyAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-25 10:39:22 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 66.56.86.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 25 05:39:17.018327 2025] [security2:error] [pid 15751:tid 15751] [client 66.56.86.251:46507] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|barnesandbrower.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "barnesandbrower.com"] [uri "/restore/wallet.dat"] [unique_id "aU0UVej4eDVuNXBd_J2i9QAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 179.56.173.132

🇺🇸 174.138.69.246

🇺🇸 147.185.132.210

🇺🇸 147.185.132.83

🇹🇷 94.154.43.230

🇬🇧 35.203.210.202

🇬🇧 35.176.171.117

🇪🇸 34.175.168.5

🇬🇧 217.146.80.107

🇺🇸 216.25.89.125

🇰🇷 211.37.174.180

🇫🇷 195.25.75.65

🇮🇹 188.114.102.46

🇺🇸 172.71.22.19

🇻🇳 116.110.209.70

🇺🇸 76.39.167.31

🇵🇭 65.181.9.208

🇺🇸 47.251.122.238

🇷🇺 46.147.113.91

🇧🇷 45.205.1.245