IP address

Shodan(more info)

Passive DNS

Tags: Scanner

Warden events (20)

2026-01-21: ReconScanning (node.86eb21): 2
2026-01-19: ReconScanning (node.86eb21): 2
2026-01-15: ReconScanning (node.86eb21): 2
2026-01-11: ReconScanning (node.86eb21): 3
2026-01-09: ReconScanning (node.86eb21): 2
2025-12-25: ReconScanning (node.86eb21): 1
2025-12-24: ReconScanning (node.86eb21): 1
2025-12-13: ReconScanning (node.86eb21): 1
2025-12-09: ReconScanning (node.86eb21): 1
2025-12-08: ReconScanning (node.86eb21): 1
2025-12-07: ReconScanning (node.86eb21): 1
2025-12-02: ReconScanning (node.86eb21): 1
2025-11-09: ReconScanning (node.86eb21): 1
2025-11-08: ReconScanning (node.86eb21): 1

DShield reports (IP summary, reports)

2025-11-12: Number of reports: 56; Distinct targets: 9
2025-11-21: Number of reports: 44; Distinct targets: 7
2025-11-26: Number of reports: 48; Distinct targets: 6
2026-01-01: Number of reports: 43; Distinct targets: 4
2026-01-02: Number of reports: 43; Distinct targets: 4

Origin AS: AS204094 - I4W
BGP Prefix: 185.113.140.0/24
geo: Portugal, Lisbon; 🕑 Europe/Lisbon
hostname: fakewrithe.com
Address block ('inetnum' or 'NetRange' in whois database): 185.113.140.0 - 185.113.143.255
last_activity: 2026-01-21 02:06:29
last_warden_event: 2026-01-21 02:06:29
rep: 0.021428571428571425
reserved_range: 0
Shodan's InternetDB: Open ports: 11, 13, 15, 17, 21, 22, 25, 26, 49, 70, 79, 80, 81, 82, 83, 84, 86, 102, 110, 111, 113, 119, 122, 135, 143, 179, 195, 221, 234, 264, 285, 311, 389, 443, 444, 445, 480, 502, 515, 541, 548, 554, 593, 631, 636, 689, 789, 831, 873, 902, 953, 992, 993, 995, 999, 1025, 1080, 1099, 1200, 1234, 1365, 1414, 1433, 1443, 1500, 1515, 1521, 1554, 1599, 1604, 1723, 1741, 1800, 1801, 1833, 1883, 1935, 1950, 1955, 1959, 1962, 1965, 1974, 2000, 2008, 2067, 2081, 2082, 2083, 2086, 2087, 2095, 2121, 2154, 2222, 2223, 2224, 2225, 2345, 2375, 2376, 2379, 2444, 2549, 2553, 2566, 2628, 2761, 2762, 2985, 3000, 3001, 3014, 3015, 3017, 3018, 3019, 3053, 3075, 3083, 3084, 3092, 3093, 3096, 3101, 3128, 3143, 3150, 3175, 3181, 3187, 3189, 3190, 3191, 3196, 3260, 3268, 3269, 3299, 3306, 3310, 3337, 3352, 3388, 3389, 3409, 3541, 3542, 3567, 3790, 4000, 4002, 4022, 4064, 4150, 4157, 4160, 4242, 4282, 4321, 4344, 4369, 4433, 4434, 4444, 4463, 4466, 4500, 4506, 4528, 4561, 4567, 4664, 4782, 4786, 4821, 4899, 4911, 4949, 5000, 5005, 5006, 5007, 5010, 5025, 5123, 5135, 5201, 5222, 5224, 5234, 5241, 5269, 5271, 5279, 5357, 5432, 5433, 5435, 5456, 5558, 5595, 5601, 5605, 5671, 5672, 5680, 5721, 5800, 5801, 5853, 5858, 5900, 5901, 5917, 5984, 5985, 6000, 6001, 6379, 6400, 6432, 6503, 6565, 6600, 6605, 6633, 6653, 6662, 6664, 6668, 6697, 7001, 7005, 7015, 7057, 7090, 7171, 7173, 7349, 7373, 7434, 7443, 7547, 7548, 7634, 7654, 7657, 7773, 7782, 7979, 7989, 8001, 8005, 8009, 8012, 8017, 8024, 8028, 8038, 8060, 8069, 8081, 8083, 8086, 8087, 8090, 8107, 8112, 8123, 8124, 8126, 8128, 8133, 8137, 8139, 8140, 8150, 8152, 8169, 8174, 8183, 8188, 8200, 8236, 8333, 8407, 8420, 8425, 8443, 8444, 8448, 8458, 8461, 8467, 8485, 8504, 8545, 8548, 8549, 8560, 8588, 8680, 8703, 8708, 8724, 8728, 8800, 8812, 8846, 8876, 8877, 8890, 8891, 8915, 8916, 9000, 9001, 9002, 9009, 9022, 9027, 9033, 9042, 9050, 9051, 9059, 9080, 9090, 9091, 9092, 9095, 9100, 9127, 9138, 9144, 9151, 9160, 9162, 9163, 9169, 9175, 9185, 9191, 9200, 9201, 9203, 9209, 9222, 9248, 9295, 9306, 9333, 9398, 9418, 9507, 9513, 9600, 9633, 9690, 9761, 9800, 9802, 9869, 9876, 9888, 9900, 9922, 9943, 9981, 9992, 9998; Tags: honeypot; CPEs: cpe:/a:openbsd:openssh:8.2p1, cpe:/o:canonical:ubuntu_linux
ts_added: 2024-11-13 05:17:57.093000
ts_last_update: 2026-01-31 05:18:00.677000

Warden event timeline

DShield event timeline