IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

192.253.248.33 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-03-14 18:27:20.476000
Was present on blacklist at: 2026-02-21 18:27, 2026-02-28 18:27, 2026-03-09 08:46, 2026-03-14 18:27

Spamhaus DROP

192.253.248.33 is listed on the Spamhaus DROP blacklist.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-03-14 18:27:20.476000
Was present on blacklist at: 2026-02-21 18:27, 2026-02-28 18:27, 2026-03-09 08:46, 2026-03-14 18:27

AbuseIPDB

192.253.248.33 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-03-14 05:00:00.644000
Was present on blacklist at: 2026-02-22 05:00, 2026-02-23 05:00, 2026-02-24 05:00, 2026-02-25 05:00, 2026-02-26 05:00, 2026-02-27 05:00, 2026-02-28 05:00, 2026-03-01 05:00, 2026-03-02 05:00, 2026-03-03 05:00, 2026-03-04 05:00, 2026-03-05 05:00, 2026-03-06 05:00, 2026-03-10 05:00, 2026-03-11 05:00, 2026-03-12 05:00, 2026-03-13 05:00, 2026-03-14 05:00

Turris greylist

192.253.248.33 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC,<br>which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2026-03-03 22:15:00.119000
Was present on blacklist at: 2026-03-03 22:15

Echelon SSH bruteforce

192.253.248.33 is listed on the Echelon SSH bruteforce blacklist.

Description: Multiple SSH authentication attempts detected
Type of feed: primary (feed detail page)

Last checked at: 2026-03-12 10:35:00.389000
Was present on blacklist at: 2026-03-05 10:35, 2026-03-06 10:35, 2026-03-11 10:35, 2026-03-12 10:35

Echelon telnet bruteforce

192.253.248.33 is listed on the Echelon telnet bruteforce blacklist.

Description: Multiple telnet authentication attempts detected
Type of feed: primary (feed detail page)

Last checked at: 2026-03-12 10:45:00.338000
Was present on blacklist at: 2026-03-11 10:45, 2026-03-12 10:45

Threat categories

TL	Role	Category	Details
67	src	scan	port: many
33	src	login	protocol: ssh, telnet
25	src	—

Warden events (8539)

2026-03-14: ReconScanning (node.4dc198): 159; ReconScanning (node.368407): 127; ReconScanning (node.9c1411): 27
2026-03-13: ReconScanning (node.4dc198): 210; ReconScanning (node.368407): 92; ReconScanning (node.9c1411): 35
2026-03-12: ReconScanning (node.4dc198): 176; ReconScanning (node.368407): 185; ReconScanning (node.9c1411): 43
2026-03-11: ReconScanning (node.368407): 177; ReconScanning (node.4dc198): 245; ReconScanning (node.9c1411): 45
2026-03-10: ReconScanning (node.4dc198): 210; ReconScanning (node.368407): 218; ReconScanning (node.9c1411): 44
2026-03-08: ReconScanning (node.4dc198): 42; ReconScanning (node.9c1411): 7; ReconScanning (node.368407): 25
2026-03-07: ReconScanning (node.368407): 172; ReconScanning (node.4dc198): 193; ReconScanning (node.9c1411): 36
2026-03-06: ReconScanning (node.4dc198): 66; ReconScanning (node.368407): 45; ReconScanning (node.9c1411): 27
2026-03-05: ReconScanning (node.368407): 108; ReconScanning (node.4dc198): 102; ReconScanning (node.9c1411): 27
2026-03-04: ReconScanning (node.4dc198): 228; ReconScanning (node.9c1411): 36; ReconScanning (node.368407): 123
2026-03-03: ReconScanning (node.4dc198): 284; ReconScanning (node.368407): 174; ReconScanning (node.9c1411): 41
2026-03-02: ReconScanning (node.368407): 197; ReconScanning (node.4dc198): 258; ReconScanning (node.9c1411): 52
2026-03-01: ReconScanning (node.4dc198): 264; ReconScanning (node.368407): 221; ReconScanning (node.9c1411): 48
2026-02-28: ReconScanning (node.368407): 190; ReconScanning (node.4dc198): 218; ReconScanning (node.9c1411): 39
2026-02-27: ReconScanning (node.4dc198): 282; ReconScanning (node.368407): 260; ReconScanning (node.9c1411): 57
2026-02-26: ReconScanning (node.4dc198): 242; ReconScanning (node.368407): 226; ReconScanning (node.9c1411): 53
2026-02-25: ReconScanning (node.4dc198): 244; ReconScanning (node.9c1411): 49; ReconScanning (node.368407): 207
2026-02-24: ReconScanning (node.368407): 235; ReconScanning (node.4dc198): 273; ReconScanning (node.9c1411): 46
2026-02-23: ReconScanning (node.368407): 226; ReconScanning (node.4dc198): 269; ReconScanning (node.9c1411): 55
2026-02-22: ReconScanning (node.4dc198): 226; ReconScanning (node.9c1411): 44; ReconScanning (node.368407): 180
2026-02-21: ReconScanning (node.4dc198): 69; ReconScanning (node.368407): 67; ReconScanning (node.9c1411): 13

DShield reports (IP summary, reports)

2026-02-24: Number of reports: 1615; Distinct targets: 769
2026-02-25: Number of reports: 1615; Distinct targets: 769
2026-02-26: Number of reports: 1465; Distinct targets: 737
2026-02-27: Number of reports: 1470; Distinct targets: 755
2026-02-28: Number of reports: 1746; Distinct targets: 827
2026-03-01: Number of reports: 1442; Distinct targets: 702
2026-03-02: Number of reports: 1557; Distinct targets: 780
2026-03-03: Number of reports: 743; Distinct targets: 480
2026-03-04: Number of reports: 697; Distinct targets: 442
2026-03-05: Number of reports: 697; Distinct targets: 442
2026-03-06: Number of reports: 495; Distinct targets: 357
2026-03-10: Number of reports: 781; Distinct targets: 498
2026-03-11: Number of reports: 622; Distinct targets: 416
2026-03-12: Number of reports: 723; Distinct targets: 450
2026-03-13: Number of reports: 723; Distinct targets: 450

Origin AS: AS213790 - LimitedNetwork-AS
BGP Prefix: 192.253.248.0/24
geo: United States; 🕑 America/Chicago
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 192.253.240.0 - 192.253.255.255
last_activity: 2026-03-14 18:42:49
last_warden_event: 2026-03-14 18:42:49
rep: 0.8
reserved_range: 0
ts_added: 2026-02-21 18:27:17.956000
ts_last_update: 2026-03-14 18:43:03.354000

Warden event timeline

DShield event timeline

Presence on blacklists