IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

157.254.165.99 was recently listed on the Spamhaus SBL blacklist, but currently it is not.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-06-30 05:09:05.511000
Was present on blacklist at: 2024-05-19 05:05, 2024-05-26 05:06, 2024-06-02 05:05

Spamhaus XBL CBL

157.254.165.99 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-06-30 05:09:05.511000
Was present on blacklist at: 2024-05-19 05:05, 2024-05-26 05:06, 2024-06-02 05:05, 2024-06-09 05:12, 2024-06-16 05:09, 2024-06-23 05:06

AbuseIPDB

157.254.165.99 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc. IPs performing malicious activity(DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2024-06-04 04:00:00.510000
Was present on blacklist at: 2024-05-20 04:00, 2024-05-23 04:00, 2024-05-26 04:00, 2024-06-04 04:00

Turris greylist

157.254.165.99 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC, which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2024-06-16 21:15:00.187000
Was present on blacklist at: 2024-05-20 21:15, 2024-05-22 21:15, 2024-05-23 21:15, 2024-05-26 21:15, 2024-06-05 21:15, 2024-06-06 21:15, 2024-06-07 21:15, 2024-06-08 21:15, 2024-06-09 21:15, 2024-06-11 21:15, 2024-06-13 21:15, 2024-06-16 21:15

Spamhaus DROP

157.254.165.99 was recently listed on the Spamhaus DROP blacklist, but currently it is not.

Description: The Spamhaus DROP (Don't Route Or Peer) lists are advisory"drop all traffic" lists. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-06-30 05:09:05.511000
Was present on blacklist at: 2024-05-26 05:06, 2024-06-02 05:05

blocklist.de web-login

157.254.165.99 is listed on the blocklist.de web-login blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs that attacks Joomla, Wordpress and other Web-Logins with Brute-Force Logins.
Type of feed: primary (feed detail page)

Last checked at: 2024-06-12 10:05:00.228000
Was present on blacklist at: 2024-06-10 16:05, 2024-06-10 22:05, 2024-06-11 04:05, 2024-06-11 10:05, 2024-06-11 16:05, 2024-06-11 22:05, 2024-06-12 04:05, 2024-06-12 10:05

blocklist.de Apache

157.254.165.99 is listed on the blocklist.de Apache blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs performing attacks on the service Apache, Apache-DDOS, RFI-Attacks.
Type of feed: primary (feed detail page)

Last checked at: 2024-06-12 10:05:00.374000
Was present on blacklist at: 2024-06-10 16:05, 2024-06-10 22:05, 2024-06-11 04:05, 2024-06-11 10:05, 2024-06-11 16:05, 2024-06-11 22:05, 2024-06-12 04:05, 2024-06-12 10:05

Warden events (35)

2024-06-05: ReconScanning (node.8cbf96): 6
2024-05-27: ReconScanning (node.8cbf96): 16
2024-05-25: ReconScanning (node.293592): 2
2024-05-23: ReconScanning (node.8cbf96): 1
2024-05-22: ReconScanning (node.8cbf96): 4
2024-05-21: ReconScanning (node.8cbf96): 6

DShield reports (IP summary, reports)

2024-05-18: Number of reports: 15; Distinct targets: 4
2024-05-19: Number of reports: 18; Distinct targets: 13
2024-05-20: Number of reports: 39; Distinct targets: 22
2024-05-21: Number of reports: 23; Distinct targets: 13
2024-05-22: Number of reports: 23; Distinct targets: 9
2024-05-27: Number of reports: 60; Distinct targets: 32
2024-06-03: Number of reports: 14; Distinct targets: 4
2024-06-04: Number of reports: 16; Distinct targets: 4
2024-06-05: Number of reports: 53; Distinct targets: 27
2024-06-07: Number of reports: 28; Distinct targets: 10
2024-06-10: Number of reports: 18; Distinct targets: 15
2024-06-11: Number of reports: 15; Distinct targets: 4
2024-06-13: Number of reports: 18; Distinct targets: 10
2024-06-14: Number of reports: 15; Distinct targets: 6

OTX pulses

[5a7e3e70c44e7b48947593a7] 2018-02-10 00:36:00.396000 | Webscanners 2018-02-09 thru current day

Author name:	david3
Pulse modified:	2024-07-05 15:55:14.904000
Indicator created:	2024-06-06 08:30:12
Indicator role:	scanning_host
Indicator title:	404 NOT FOUND
Indicator expiration:	2024-09-04 00:00:00

Origin AS: AS399486 - VIRTUO
BGP Prefix: 157.254.164.0/23
geo: United States, Edison; 🕑 America/New_York
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 157.254.0.0 - 157.254.255.255
last_activity: 2024-07-05 16:20:51.138000
last_warden_event: 2024-06-05 16:29:39
rep: 0.0
reserved_range: 0
Shodan's InternetDB: Open ports: 3389; Tags: scanner, self-signed; CPEs: –
ts_added: 2024-05-19 05:05:02.597000
ts_last_update: 2024-07-05 16:20:52.329000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses