This IP address has been reported a total of
46
times from
43 distinct
sources.
143.198.159.21 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 15
reports;
United States of America
with 13
reports;
Poland
with 3
reports.
The most common categories in these recent reports were:
Brute-Force
32
times;
SSH
31
times;
Web App Attack
10
times;
Port Scan
6
times;
Hacking
3
times;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 14 14:35:43 sg-mirror sshd[167077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ...
show moreOct 14 14:35:43 sg-mirror sshd[167077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.159.21
Oct 14 14:35:45 sg-mirror sshd[167077]: Failed password for invalid user admin from 143.198.159.21 port 40918 ssh2
...
show less
2026-10-14T16:29:02.290627+02:00 hz-dedi-sx134-fsn sshd-session[3910688]: Invalid user admin from 14 ...
show more2026-10-14T16:29:02.290627+02:00 hz-dedi-sx134-fsn sshd-session[3910688]: Invalid user admin from 143.198.159.21 port 46154
2026-10-14T16:29:33.578677+02:00 hz-dedi-sx134-fsn sshd-session[3911149]: Invalid user user from 143.198.159.21 port 48360
2026-10-14T16:30:39.116999+02:00 hz-dedi-sx134-fsn sshd-session[3912059]: Invalid user user from 143.198.159.21 port 33520
...
show less
Web scanning: repeated requests for files and exploit paths this site does not serve (.env, .git, ph ...
show moreWeb scanning: repeated requests for files and exploit paths this site does not serve (.env, .git, phpunit, cgi-bin). Reported by fail2ban.
show less
2026-10-14T13:26:48.800262 host sshd-session[622667]: Invalid user XXXX from 143.198.159.21 not allo ...
show more2026-10-14T13:26:48.800262 host sshd-session[622667]: Invalid user XXXX from 143.198.159.21 not allowed because not listed in AllowUsers
show less
(mod_security) mod_security (id:218420) triggered by 143.198.159.21 (-): 1 in the last 300 secs; Por ...
show more(mod_security) mod_security (id:218420) triggered by 143.198.159.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 08:40:14.778915 2026] [security2:error] [pid 417:tid 417] [client 143.198.159.21:58568] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.204:80|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.204"] [uri "/hello.world"] [unique_id "as94LgKo4z9viOOxdWO7PgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-14T14:31:29.923456+02:00 mail sshd[2846463]: pam_unix(sshd:auth): authentication failure; lo ...
show more2026-10-14T14:31:29.923456+02:00 mail sshd[2846463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.159.21
2026-10-14T14:31:32.097132+02:00 mail sshd[2846463]: Failed password for invalid user admin from 143.198.159.21 port 42534 ssh2
2026-10-14T14:32:20.802165+02:00 mail sshd[2846481]: Invalid user user from 143.198.159.21 port 39526
...
show less
(mod_security) mod_security (id:949110) triggered by 143.198.159.21 (US/United States/-): 5 in the l ...
show more(mod_security) mod_security (id:949110) triggered by 143.198.159.21 (US/United States/-): 5 in the last 3600 secs [SIGMA]
show less
2026-10-14T13:07:15.109634+02:00 pve sshd-session[2090753]: pam_unix(sshd:auth): authentication fail ...
show more2026-10-14T13:07:15.109634+02:00 pve sshd-session[2090753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.198.159.21
2026-10-14T13:07:17.379276+02:00 pve sshd-session[2090753]: Failed password for invalid user admin from 143.198.159.21 port 49510 ssh2
2026-10-14T13:07:55.171433+02:00 pve sshd-session[2092699]: Invalid user user from 143.198.159.21 port 51180
...
show less
