IP address

Passive DNS

Tags: IP in hostname

IP blacklists

Echelon SIP register scanner

163.172.31.144 was recently listed on the Echelon SIP register scanner blacklist, but currently it is not.

Description: IPs detected by Echelon sensors (honeypots) as performing this activity: SIP VoIP registration scanning on port 5060
Type of feed: primary (feed detail page)

Last checked at: 2026-10-13 09:30:00.764000
Was present on blacklist at: 2026-09-17 09:30, 2026-09-18 09:30, 2026-09-23 09:30, 2026-09-24 09:30, 2026-09-25 09:30, 2026-09-27 09:30, 2026-09-28 09:30, 2026-09-29 09:30, 2026-09-30 09:30, 2026-10-01 09:30, 2026-10-07 09:30, 2026-10-08 09:30, 2026-10-09 09:30, 2026-10-10 09:30, 2026-10-11 09:30, 2026-10-12 09:30, 2026-10-13 09:30

Echelon port scan

163.172.31.144 is listed on the Echelon port scan blacklist.

Description: IPs detected by Echelon sensors (honeypots) as performing this activity: Scanning 5+ ports on target host
Type of feed: primary (feed detail page)

Last checked at: 2026-10-23 09:25:00.610000
Was present on blacklist at: 2026-09-23 09:25, 2026-09-24 09:25, 2026-09-25 09:25, 2026-09-26 09:25, 2026-09-27 09:25, 2026-09-28 09:25, 2026-10-21 09:25, 2026-10-22 09:25, 2026-10-23 09:25

CI Army

163.172.31.144 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence<br>database that provides scores for IPs. Source of unspecified malicious attacks<br>most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2026-10-23 02:50:00.956000
Was present on blacklist at: 2026-09-27 02:50, 2026-09-28 02:50, 2026-09-29 02:50, 2026-09-30 02:50, 2026-10-01 02:50, 2026-10-04 02:50, 2026-10-05 02:50, 2026-10-07 02:50, 2026-10-08 02:50, 2026-10-12 02:50, 2026-10-13 02:50, 2026-10-14 02:50, 2026-10-15 02:50, 2026-10-16 02:50, 2026-10-17 02:50, 2026-10-18 02:50, 2026-10-19 02:50, 2026-10-20 02:50, 2026-10-21 02:50, 2026-10-22 02:50, 2026-10-23 02:50

AbuseIPDB

163.172.31.144 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-10-23 04:00:00.664000
Was present on blacklist at: 2026-10-18 04:00, 2026-10-19 04:00, 2026-10-21 04:00, 2026-10-23 04:00

Threat categories

TL	Role	Category	Details
58	src	scan	port: 5038, 8060, 8089, 9876
31	src	—

Warden events (559)

2026-10-22: ReconScanning (node.ce2b59): 6; ReconScanning (node.368407): 46; ReconScanning (node.4dc198): 46
2026-10-20: ReconScanning (node.ce2b59): 5; ReconScanning (node.368407): 29; ReconScanning (node.4dc198): 33
2026-10-17: ReconScanning (node.ce2b59): 5; ReconScanning (node.4dc198): 31; ReconScanning (node.368407): 31
2026-10-14: ReconScanning (node.ce2b59): 1
2026-10-13: ReconScanning (node.ce2b59): 5; ReconScanning (node.368407): 30; ReconScanning (node.4dc198): 31
2026-10-12: ReconScanning (node.4dc198): 32; ReconScanning (node.ce2b59): 10; ReconScanning (node.368407): 18
2026-10-11: ReconScanning (node.ce2b59): 20; ReconScanning (node.4dc198): 61
2026-10-07: ReconScanning (node.ce2b59): 12; ReconScanning (node.368407): 31; ReconScanning (node.4dc198): 31
2026-09-21: ReconScanning (node.f90c6b): 24; ReconScanning (node.86eb21): 21

DShield reports (IP summary, reports)

2026-09-18: Number of reports: 128930; Distinct targets: 64465
2026-09-19: Number of reports: 128930; Distinct targets: 64465
2026-09-21: Number of reports: 12281; Distinct targets: 7540
2026-09-23: Number of reports: 276; Distinct targets: 138
2026-09-24: Number of reports: 550; Distinct targets: 213
2026-09-25: Number of reports: 550; Distinct targets: 213
2026-09-26: Number of reports: 156; Distinct targets: 80
2026-09-27: Number of reports: 156; Distinct targets: 80
2026-09-28: Number of reports: 108; Distinct targets: 63
2026-09-29: Number of reports: 104; Distinct targets: 51
2026-10-03: Number of reports: 402; Distinct targets: 272
2026-10-05: Number of reports: 21; Distinct targets: 12
2026-10-07: Number of reports: 306; Distinct targets: 219
2026-10-10: Number of reports: 104; Distinct targets: 64
2026-10-11: Number of reports: 161; Distinct targets: 135
2026-10-12: Number of reports: 242; Distinct targets: 160
2026-10-14: Number of reports: 209; Distinct targets: 162
2026-10-15: Number of reports: 25; Distinct targets: 23
2026-10-16: Number of reports: 12; Distinct targets: 5
2026-10-21: Number of reports: 209; Distinct targets: 161

Origin AS: AS12876 - AS12876
BGP Prefix: 163.172.0.0/16
geo: France, Paris; 🕑 Europe/Paris
hostname: 163-172-31-144.rev.poneytelecom.eu
hostname_class: ['ip_in_hostname']
Address block ('inetnum' or 'NetRange' in whois database): 163.172.0.0 - 163.172.255.255
last_activity: 2026-10-22 09:18:20
last_warden_event: 2026-10-22 09:18:20
rep: 0.5555488373188278
reserved_range: 0
Shodan's InternetDB: Open ports: 22, 111, 123, 2222, 3128, 5151; Tags: scanner; CPEs: cpe:/a:openbsd:openssh:7.4, cpe:/a:ntp:ntp:3, cpe:/a:openbsd:openssh:9.9
ts_added: 2026-09-17 09:30:05.729000
ts_last_update: 2026-10-23 09:30:11.460000

Warden event timeline

DShield event timeline

Presence on blacklists