148.66.142.18 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Singapore

Internet Service Provider: GoDaddy.com

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	php WP PHPmyadamin ABUSE blocked for 12h	2019-10-20 08:24:59
attackspambots	148.66.142.18 - - [12/Oct/2019:08:03:02 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.18 - - [12/Oct/2019:08:03:03 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.18 - - [12/Oct/2019:08:03:04 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.18 - - [12/Oct/2019:08:03:05 +0200] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.18 - - [12/Oct/2019:08:03:05 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.18 - - [12/Oct/2019:08:03:06 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-10-12 15:19:16
attack	Trying: /wordpress/wp-login.php	2019-09-21 16:57:54

Type

Details

Datetime

attackbots

php WP PHPmyadamin ABUSE blocked for 12h

2019-10-20 08:24:59

attackspambots

148.66.142.18 - - [12/Oct/2019:08:03:02 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.142.18 - - [12/Oct/2019:08:03:03 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.142.18 - - [12/Oct/2019:08:03:04 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.142.18 - - [12/Oct/2019:08:03:05 +0200] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.142.18 - - [12/Oct/2019:08:03:05 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.142.18 - - [12/Oct/2019:08:03:06 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

2019-10-12 15:19:16

attack

Trying:
/wordpress/wp-login.php

2019-09-21 16:57:54

Comments on same subnet:

IP	Type	Details	Datetime
148.66.142.135	attackbotsspam	Port Scan detected from 148.66.142.135 (SG/Singapore/-/Singapore (Pioneer)/-). 4 hits in the last 115 seconds	2020-08-29 04:54:49
148.66.142.135	attack	Aug 25 01:48:04 NPSTNNYC01T sshd[3831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.142.135 Aug 25 01:48:06 NPSTNNYC01T sshd[3831]: Failed password for invalid user quadir from 148.66.142.135 port 44014 ssh2 Aug 25 01:52:57 NPSTNNYC01T sshd[4215]: Failed password for root from 148.66.142.135 port 53756 ssh2 ...	2020-08-25 14:11:09
148.66.142.174	attackspambots	Aug 11 15:42:57 b-vps wordpress(gpfans.cz)[30596]: Authentication attempt for unknown user buchtic from 148.66.142.174 ...	2020-08-11 22:56:38
148.66.142.174	attackbotsspam	Automatic report - Banned IP Access	2020-08-06 12:09:18
148.66.142.174	attackspam	148.66.142.174 - - [01/Aug/2020:05:21:25 +0100] "POST /wp-login.php HTTP/1.1" 200 1905 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.174 - - [01/Aug/2020:05:21:27 +0100] "POST /wp-login.php HTTP/1.1" 200 1954 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.142.174 - - [01/Aug/2020:05:21:29 +0100] "POST /wp-login.php HTTP/1.1" 200 1949 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-01 18:25:15
148.66.142.135	attackbotsspam	2020-06-28T04:09:08.549753shield sshd\[26759\]: Invalid user mysql_public from 148.66.142.135 port 39356 2020-06-28T04:09:08.555335shield sshd\[26759\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.142.135 2020-06-28T04:09:10.824865shield sshd\[26759\]: Failed password for invalid user mysql_public from 148.66.142.135 port 39356 ssh2 2020-06-28T04:12:25.394664shield sshd\[28342\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.142.135 user=root 2020-06-28T04:12:27.036872shield sshd\[28342\]: Failed password for root from 148.66.142.135 port 34412 ssh2	2020-06-28 12:22:58
148.66.142.135	attack	May 16 13:02:47 vps46666688 sshd[21456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.142.135 May 16 13:02:50 vps46666688 sshd[21456]: Failed password for invalid user tullio from 148.66.142.135 port 48260 ssh2 ...	2020-05-17 02:56:08
148.66.142.135	attack	SSH Brute-Force Attack	2020-05-13 20:35:41
148.66.142.135	attackbotsspam	Unauthorized connection attempt detected from IP address 148.66.142.135 to port 2220 [J]	2020-02-05 02:51:00
148.66.142.135	attackspam	...	2020-02-01 23:58:07
148.66.142.135	attackspambots	...	2020-01-19 21:09:26
148.66.142.1	attackbots	SSH login attempts with user root at 2020-01-02.	2020-01-03 02:38:16
148.66.142.135	attackbotsspam	Automatic report - Banned IP Access	2019-12-25 21:45:38
148.66.142.135	attack	Dec 24 13:21:59 XXXXXX sshd[26433]: Invalid user shell from 148.66.142.135 port 45986	2019-12-24 22:40:44
148.66.142.161	attackbotsspam	xmlrpc attack	2019-12-02 03:10:20

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 148.66.142.18
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4735
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;148.66.142.18.			IN	A

;; AUTHORITY SECTION:
.			433	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019091802 1800 900 604800 86400

;; Query time: 105 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Sep 19 21:09:52 CST 2019
;; MSG SIZE  rcvd: 117

Host info

Host 18.142.66.148.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 18.142.66.148.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
193.228.91.123	attackspambots	TCP (SYN) 193.228.91.123:54865 -> port 22, len 48	2020-09-16 20:50:20
27.147.191.254	attackspambots	MYH,DEF GET /Admin/ServerSide/Telerik.Web.UI.DialogHandler.aspx	2020-09-16 20:55:37
116.68.205.186	attackspambots	Unauthorized connection attempt from IP address 116.68.205.186 on Port 445(SMB)	2020-09-16 20:32:32
46.109.40.52	attackbots	Sep 15 21:02:11 ssh2 sshd[64367]: User root from 46.109.40.52 not allowed because not listed in AllowUsers Sep 15 21:02:12 ssh2 sshd[64367]: Failed password for invalid user root from 46.109.40.52 port 34964 ssh2 Sep 15 21:02:12 ssh2 sshd[64367]: Connection closed by invalid user root 46.109.40.52 port 34964 [preauth] ...	2020-09-16 20:28:22
2804:14d:5c50:815f:291b:894:b287:7164	attackspambots	Wordpress attack	2020-09-16 20:42:39
90.84.189.254	attack	Sep 16 14:30:34 fhem-rasp sshd[633]: Failed password for root from 90.84.189.254 port 47588 ssh2 Sep 16 14:30:34 fhem-rasp sshd[633]: Disconnected from authenticating user root 90.84.189.254 port 47588 [preauth] ...	2020-09-16 20:43:06
212.70.149.52	attackspambots	Sep 16 14:47:51 srv01 postfix/smtpd\[22961\]: warning: unknown\[212.70.149.52\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 16 14:47:53 srv01 postfix/smtpd\[13903\]: warning: unknown\[212.70.149.52\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 16 14:47:57 srv01 postfix/smtpd\[11699\]: warning: unknown\[212.70.149.52\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 16 14:47:59 srv01 postfix/smtpd\[17325\]: warning: unknown\[212.70.149.52\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 16 14:48:17 srv01 postfix/smtpd\[17325\]: warning: unknown\[212.70.149.52\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ...	2020-09-16 20:53:13
23.160.208.246	attackbots	Sep 16 12:32:06 l02a sshd[22977]: Invalid user admin from 23.160.208.246 Sep 16 12:32:06 l02a sshd[22977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.160.208.246 Sep 16 12:32:06 l02a sshd[22977]: Invalid user admin from 23.160.208.246 Sep 16 12:32:08 l02a sshd[22977]: Failed password for invalid user admin from 23.160.208.246 port 37965 ssh2	2020-09-16 20:37:18
106.54.220.54	attackbots	Sep 16 14:42:53 mout sshd[3692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.220.54 user=root Sep 16 14:42:54 mout sshd[3692]: Failed password for root from 106.54.220.54 port 55016 ssh2	2020-09-16 20:52:13
106.12.125.178	attackbots	B: Abusive ssh attack	2020-09-16 20:59:43
103.135.32.238	attack	TCP (SYN) 103.135.32.238:50465 -> port 445, len 52	2020-09-16 20:30:16
212.64.95.187	attack	Sep 16 07:15:02 Tower sshd[6429]: Connection from 212.64.95.187 port 40004 on 192.168.10.220 port 22 rdomain "" Sep 16 07:15:03 Tower sshd[6429]: Failed password for root from 212.64.95.187 port 40004 ssh2 Sep 16 07:15:04 Tower sshd[6429]: Received disconnect from 212.64.95.187 port 40004:11: Bye Bye [preauth] Sep 16 07:15:04 Tower sshd[6429]: Disconnected from authenticating user root 212.64.95.187 port 40004 [preauth]	2020-09-16 20:35:20
164.90.217.12	attack	Invalid user admin from 164.90.217.12 port 11394	2020-09-16 20:21:40
91.230.10.156	attackspam	10 attempts against mh-pma-try-ban on oak	2020-09-16 20:31:42
118.89.228.58	attackbotsspam	Sep 16 07:16:54 markkoudstaal sshd[16565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.228.58 Sep 16 07:16:56 markkoudstaal sshd[16565]: Failed password for invalid user Gretel from 118.89.228.58 port 52669 ssh2 Sep 16 07:19:59 markkoudstaal sshd[17367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.228.58 ...	2020-09-16 20:51:55

Recently Reported IPs

184.68.96.62	183.88.171.200	138.68.209.144	119.194.248.131
12.13.190.108	138.157.166.82	115.239.64.49	111.255.28.144
138.197.146.132	46.38.144.57	222.188.21.39	197.44.227.179
183.131.110.52	122.224.158.58	76.103.161.19	48.7.26.240
209.97.168.14	152.233.242.140	159.18.13.14	18.87.175.1