In the output of `last`, what does suffix ".d" after an IP address mean?

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it.

Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns.

Try last -a to display the hostname on the last column without truncation. or last -i to display the ip-address.

Compare:

$ last -n 1  name
name      pts/0        host38.resource. Mon Aug 17 15:46 - 16:00  (00:13)

$ last -n 1 -a name
name      pts/0        Mon Aug 17 15:46 - 16:00  (00:13)     host38.resource.hq.example.com

$ last -n 1 -i name
name      pts/0        10.9.8.38        Mon Aug 17 15:46 - 16:00  (00:13)

The -i makes 'last' show the remote hostname in dots and numbers IP address format instead of trying to display the hostname.

I am not sure what the '.d' suffix is, nor can I find out anything on google. I can only guess it is trying to do a reverse lookup and is giving you part of a hostname and truncating it, although i thought you must specify -d to do hostnames.