148.66.143.78 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Singapore

Internet Service Provider: GoDaddy.com

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Automatic report - Banned IP Access	2020-04-05 06:07:09
attack	148.66.143.78 - - \[16/Mar/2020:06:12:00 +0100\] "POST /wp-login.php HTTP/1.0" 200 7427 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 148.66.143.78 - - \[16/Mar/2020:06:12:02 +0100\] "POST /wp-login.php HTTP/1.0" 200 7242 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 148.66.143.78 - - \[16/Mar/2020:06:12:04 +0100\] "POST /wp-login.php HTTP/1.0" 200 7239 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-03-16 18:44:11
attack	CMS (WordPress or Joomla) login attempt.	2020-03-14 08:39:22
attackspam	148.66.143.78 - - \[21/Feb/2020:15:29:50 +0100\] "POST /wp-login.php HTTP/1.0" 200 4404 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 148.66.143.78 - - \[21/Feb/2020:15:29:53 +0100\] "POST /wp-login.php HTTP/1.0" 200 4236 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 148.66.143.78 - - \[21/Feb/2020:15:29:54 +0100\] "POST /xmlrpc.php HTTP/1.0" 200 736 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-02-21 23:18:12
attack	$f2bV_matches	2020-02-04 08:26:20
attackbots	148.66.143.78 - - \[29/Jan/2020:05:50:40 +0100\] "POST /wp-login.php HTTP/1.0" 200 7672 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 148.66.143.78 - - \[29/Jan/2020:05:50:42 +0100\] "POST /wp-login.php HTTP/1.0" 200 7502 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 148.66.143.78 - - \[29/Jan/2020:05:50:43 +0100\] "POST /wp-login.php HTTP/1.0" 200 7496 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-01-29 16:54:23
attack	WordPress wp-login brute force :: 148.66.143.78 0.160 - [24/Jan/2020:00:17:39 0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 1806 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"	2020-01-24 09:02:17
attackbots	Automatic report - XMLRPC Attack	2020-01-03 17:12:39
attackspam	Automatic report - XMLRPC Attack	2019-12-14 16:24:58
attack	fail2ban honeypot	2019-12-07 15:50:31
attack	Wordpress bruteforce	2019-10-11 12:10:45
attackspambots	Wordpress bruteforce	2019-10-08 00:57:20

Comments on same subnet:

IP	Type	Details	Datetime
148.66.143.89	attackbotsspam	Automatic report - XMLRPC Attack	2020-08-29 14:31:27
148.66.143.89	attackbots	148.66.143.89 - - [27/Aug/2020:06:56:28 +0200] "GET /wp-login.php HTTP/1.1" 200 8537 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.143.89 - - [27/Aug/2020:06:56:29 +0200] "POST /wp-login.php HTTP/1.1" 200 8788 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 148.66.143.89 - - [27/Aug/2020:06:56:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-08-27 19:44:36
148.66.143.89	attackspambots	php WP PHPmyadamin ABUSE blocked for 12h	2020-08-15 19:22:49

Type

Details

Datetime

148.66.143.89

attackbotsspam

Automatic report - XMLRPC Attack

2020-08-29 14:31:27

148.66.143.89

attackbots

148.66.143.89 - - [27/Aug/2020:06:56:28 +0200] "GET /wp-login.php HTTP/1.1" 200 8537 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.143.89 - - [27/Aug/2020:06:56:29 +0200] "POST /wp-login.php HTTP/1.1" 200 8788 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.143.89 - - [27/Aug/2020:06:56:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

2020-08-27 19:44:36

148.66.143.89

attackspambots

php WP PHPmyadamin ABUSE blocked for 12h

2020-08-15 19:22:49

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 148.66.143.78
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51899
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;148.66.143.78.			IN	A

;; AUTHORITY SECTION:
.			284	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019100701 1800 900 604800 86400

;; Query time: 134 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Oct 08 00:57:17 CST 2019
;; MSG SIZE  rcvd: 117

Host info

Host 78.143.66.148.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 78.143.66.148.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
45.143.223.10	attackbots	Feb 12 14:39:00 icecube postfix/smtpd[11646]: NOQUEUE: reject: RCPT from unknown[45.143.223.10]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=	2020-02-13 06:05:12
86.62.91.138	attackspam	SSH invalid-user multiple login attempts	2020-02-13 05:54:36
114.36.184.121	attackspam	Unauthorized connection attempt detected from IP address 114.36.184.121 to port 80	2020-02-13 05:47:07
77.40.2.103	attackbots	2020-02-12 14:39:35 auth_login authenticator failed for (localhost.localdomain) [77.40.2.103]: 535 Incorrect authentication data (set_id=admin@mhasc.org) 2020-02-12 14:39:35 auth_login authenticator failed for (localhost.localdomain) [77.40.2.103]: 535 Incorrect authentication data (set_id=administrator@mhasc.org) ...	2020-02-13 05:29:57
60.29.241.2	attackbots	Feb 12 22:32:28 mail sshd\[30353\]: Invalid user roundy from 60.29.241.2 Feb 12 22:32:28 mail sshd\[30353\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.29.241.2 Feb 12 22:32:30 mail sshd\[30353\]: Failed password for invalid user roundy from 60.29.241.2 port 5854 ssh2	2020-02-13 05:47:45
49.88.112.55	attackspam	Feb 12 06:04:39 web9 sshd\[6381\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.55 user=root Feb 12 06:04:41 web9 sshd\[6381\]: Failed password for root from 49.88.112.55 port 42352 ssh2 Feb 12 06:04:59 web9 sshd\[6434\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.55 user=root Feb 12 06:05:00 web9 sshd\[6434\]: Failed password for root from 49.88.112.55 port 1820 ssh2 Feb 12 06:05:03 web9 sshd\[6434\]: Failed password for root from 49.88.112.55 port 1820 ssh2	2020-02-13 05:56:00
61.250.146.33	attackbots	Feb 12 14:39:12 dedicated sshd[13970]: Invalid user ftpuser from 61.250.146.33 port 60244	2020-02-13 05:53:22
152.32.101.60	attackbotsspam	1581540633 - 02/12/2020 21:50:33 Host: 152.32.101.60/152.32.101.60 Port: 445 TCP Blocked	2020-02-13 05:46:15
218.92.0.189	attackspambots	Feb 12 22:49:48 legacy sshd[29266]: Failed password for root from 218.92.0.189 port 35659 ssh2 Feb 12 22:50:48 legacy sshd[29367]: Failed password for root from 218.92.0.189 port 26652 ssh2 Feb 12 22:50:50 legacy sshd[29367]: Failed password for root from 218.92.0.189 port 26652 ssh2 ...	2020-02-13 05:53:55
122.117.129.143	attack	20/2/12@10:37:09: FAIL: Alarm-Network address from=122.117.129.143 20/2/12@10:37:09: FAIL: Alarm-Network address from=122.117.129.143 ...	2020-02-13 05:59:02
92.40.22.18	attack	spying on anyone is illegal, for 15yrs even worse, tampered build to feed their racism -deal with the racism alb -tampering with ethnic minorities building even worse, brings everyone involved severe consequences - legally -well worth the wait, don't communicate with known racists 2007/2nd legal team involving the neighbour -review web workers/admins -city name usually name association/mountain view from ord muir of ord hackers/usually are tech/IT/dev/etc	2020-02-13 05:43:02
1.198.7.61	attack	Feb 12 19:35:19 debian-2gb-nbg1-2 kernel: \[3791749.487278\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=1.198.7.61 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=23036 PROTO=TCP SPT=50724 DPT=6378 WINDOW=1024 RES=0x00 SYN URGP=0	2020-02-13 06:02:49
5.59.141.113	attack	1581514775 - 02/12/2020 14:39:35 Host: 5.59.141.113/5.59.141.113 Port: 445 TCP Blocked	2020-02-13 05:29:23
117.7.200.193	attackspambots	20/2/12@08:39:38: FAIL: IoT-Telnet address from=117.7.200.193 ...	2020-02-13 05:27:22
78.115.211.53	attack	9530/tcp [2020-02-12]1pkt	2020-02-13 06:10:28

Recently Reported IPs

203.92.33.93	203.189.144.201	192.236.162.162	181.225.107.198
180.75.250.190	112.82.215.166	117.145.9.146	93.210.34.56
45.136.109.248	31.255.202.146	41.72.247.220	220.138.49.236
88.175.198.216	232.179.46.210	166.227.31.178	118.178.181.130
199.91.239.131	179.166.162.216	92.141.245.115	219.164.66.30