JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 178.223.113.159

178.223.113.159 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 46%: ?

46%

ISP	TELEKOM SRBIJA a.d.
Usage Type	Fixed Line ISP
ASN	AS8400
Domain Name	mts.rs
Country	🇷🇸 Serbia
City	Krusevac, Central Serbia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 178.223.113.159

Whois 178.223.113.159

IP Abuse Reports for 178.223.113.159:

This IP address has been reported a total of 13 times from 11 distinct sources. 178.223.113.159 was first reported on March 5th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 Luhte	2026-10-15 17:22:54 (1 day ago)	Unsolicited TCP connection from 178.223.113.159 to port 0 at 2026-10-15T17:22:54Z. Source IP complet ... show more Unsolicited TCP connection from 178.223.113.159 to port 0 at 2026-10-15T17:22:54Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring. show less	Port Scan Hacking
🇫🇷 EvoX	2026-10-14 17:04:14 (2 days ago)	🛡️ Honeypot [bsts-tpot-sensor]: Unsolicited SMB connection (dst port 445/tcp, src port 50857) to a p ... show more 🛡️ Honeypot [bsts-tpot-sensor]: Unsolicited SMB connection (dst port 445/tcp, src port 50857) to a passive honeypot sensor. No legitimate SMB service is exposed here; this traffic is consistent with automated internet-wide scanning or exploitation attempts targeting SMB (e.g. EternalBlue-class vulnerabilities). show less	Hacking
🇫🇷 sthoyer.de	2026-10-12 22:22:06 (4 days ago)	Oct 13 00:22:04 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f ... show more Oct 13 00:22:04 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=178.223.113.159 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=32193 DF PROTO=TCP SPT=51665 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇫🇷 Little Iguana	2026-10-12 22:21:02 (4 days ago)	trying to access non-authorized port	Port Scan
🇫🇷 sthoyer.de	2026-10-12 10:44:31 (4 days ago)	Oct 12 12:44:30 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f ... show more Oct 12 12:44:30 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=178.223.113.159 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=11789 DF PROTO=TCP SPT=52541 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇫🇮 Birdo	2026-10-10 06:56:45 (6 days ago)	[Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempt ... show more [Honeypot Report] Vulnerability exploitation attempt via SMB An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands. Observed: 2026-10-10 06:55 to 2026-10-10 06:56 UTC \| 4 sessions \| 16 events \| SMB (port 445) Attack chain: 1. Exploit attempt: CVE-2017-0144 2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/10/178.223.113.159.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking Port Scan
🇫🇷 EvoX	2026-10-07 04:43:48 (1 week ago)	🛡️ Honeypot [bsts-tpot-sensor]: Unsolicited SMB connection (dst port 445/tcp, src port 54727) to a p ... show more 🛡️ Honeypot [bsts-tpot-sensor]: Unsolicited SMB connection (dst port 445/tcp, src port 54727) to a passive honeypot sensor. No legitimate SMB service is exposed here; this traffic is consistent with automated internet-wide scanning or exploitation attempts targeting SMB (e.g. EternalBlue-class vulnerabilities). show less	Hacking
🇺🇸 drewf.ink	2026-10-04 05:53:37 (1 week ago)	[05:53] Sent a legacy SMB1 negotiation (Type: SMB1, Dialect(s): LANMAN1.0, LM1.2X002, NT LANMAN 1.0, ... show more [05:53] Sent a legacy SMB1 negotiation (Type: SMB1, Dialect(s): LANMAN1.0, LM1.2X002, NT LANMAN 1.0, NT LM 0.12) - no SMB2 support signaled show less	Hacking
🇫🇷 Kejult	2026-10-03 14:33:53 (1 week ago)	Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.	Port Scan
Anonymous	2024-03-11 22:07:26 (2 years ago)	Malicious activity detected Trawling for 3rd-party CMS installations	Hacking Brute-Force Web App Attack
🇺🇸 TheMadBeaker	2024-03-08 13:52:38 (2 years ago)	Fail2Ban Ban Triggered Wordpress Attack Attempt	Brute-Force Web App Attack
🇫🇷 Sklurk	2024-03-05 16:37:47 (2 years ago)	Web App Attack	Web App Attack
🇺🇦 URAN Publishing Service	2024-03-05 09:16:15 (2 years ago)	178.223.113.159 - - [05/Mar/2024:11:16:14 +0200] "GET /wp-login.php HTTP/1.1" 404 4777 "-" "Mozilla/ ... show more 178.223.113.159 - - [05/Mar/2024:11:16:14 +0200] "GET /wp-login.php HTTP/1.1" 404 4777 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 178.223.113.159 - - [05/Mar/2024:11:16:14 +0200] "GET /xmlrpc.php HTTP/1.1" 404 366 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" ... show less	Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 35.203.210.239

🇬🇧 2a06:4884:3000::3d

🇨🇭 209.99.190.186

🇨🇳 202.103.157.115

🇬🇹 190.104.114.102

🇺🇸 161.35.232.196

🇺🇸 147.185.132.123

🇩🇪 130.12.180.174

🇩🇪 130.12.180.32

🇰🇷 121.154.163.135

🇭🇰 101.36.119.203

🇬🇧 64.205.72.196

🇲🇼 41.190.94.37

🇬🇧 35.203.210.134

🇺🇸 20.168.116.207

🇺🇸 4.150.188.181

🇳🇱 185.218.86.14

🇬🇧 165.22.120.53

🇮🇷 130.193.77.236

🇮🇳 117.222.126.93