IP address

Passive DNS

Tags:

IP blacklists

blocklist.de SSH

193.111.248.144 is listed on the blocklist.de SSH blacklist.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing SSH attacks.
Type of feed: primary (feed detail page)

Last checked at: 2024-09-23 04:05:05.177000
Was present on blacklist at: 2024-09-21 16:05, 2024-09-21 22:05, 2024-09-22 04:05, 2024-09-22 10:05, 2024-09-22 16:05, 2024-09-22 22:05, 2024-09-23 04:05

Turris greylist

193.111.248.144 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC,<br>which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2024-10-19 21:15:00.210000
Was present on blacklist at: 2024-09-21 21:15, 2024-09-22 21:15, 2024-09-23 21:15, 2024-09-24 21:15, 2024-09-25 21:15, 2024-09-26 21:15, 2024-09-27 21:15, 2024-09-28 21:15, 2024-09-29 21:15, 2024-09-30 21:15, 2024-10-01 21:15, 2024-10-02 21:15, 2024-10-03 21:15, 2024-10-04 21:15, 2024-10-05 21:15, 2024-10-06 21:15, 2024-10-07 21:15, 2024-10-08 21:15, 2024-10-09 21:15, 2024-10-10 21:15, 2024-10-11 21:15, 2024-10-12 21:15, 2024-10-13 21:15, 2024-10-14 21:15, 2024-10-15 21:15, 2024-10-16 21:15, 2024-10-17 21:15, 2024-10-18 21:15, 2024-10-19 21:15

Mirai tracker

193.111.248.144 is listed on the Mirai tracker blacklist.

Description: IPs scanning the internet in a specific way known to be used by Mirai malware and its variants.
Type of feed: primary (feed detail page)

Last checked at: 2024-10-20 23:40:01.126000
Was present on blacklist at: 2024-09-21 23:40, 2024-09-22 23:40, 2024-09-23 23:40, 2024-09-25 23:40, 2024-09-26 23:40, 2024-09-27 23:40, 2024-09-28 23:40, 2024-09-29 23:40, 2024-09-30 23:40, 2024-10-14 23:40, 2024-10-15 23:40, 2024-10-16 23:40, 2024-10-17 23:40, 2024-10-18 23:40, 2024-10-19 23:40, 2024-10-20 23:40

AbuseIPDB

193.111.248.144 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2024-10-18 04:00:00.344000
Was present on blacklist at: 2024-09-22 04:00, 2024-09-23 04:00, 2024-09-24 04:00, 2024-09-25 04:00, 2024-09-26 04:00, 2024-09-27 04:00, 2024-09-28 04:00, 2024-09-29 04:00, 2024-09-30 04:00, 2024-10-01 04:00, 2024-10-02 04:00, 2024-10-03 04:00, 2024-10-04 04:00, 2024-10-05 04:00, 2024-10-06 04:00, 2024-10-07 04:00, 2024-10-08 04:00, 2024-10-09 04:00, 2024-10-10 04:00, 2024-10-11 04:00, 2024-10-13 04:00, 2024-10-14 04:00, 2024-10-15 04:00, 2024-10-16 04:00, 2024-10-17 04:00, 2024-10-18 04:00

Spamhaus XBL CBL

193.111.248.144 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-20 15:43:20.073000
Was present on blacklist at: 2024-09-27 15:43, 2024-10-04 15:43, 2024-10-11 15:43, 2024-10-18 15:43

Spamhaus SBL CSS

193.111.248.144 was recently listed on the Spamhaus SBL CSS blacklist, but currently it is not.

Description: The Spamhaus CSS is part of the SBL. CSS listings will have return code 127.0.0.3 to differentiate from regular SBL listings, which have return code 127.0.0.2.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-20 15:43:20.073000
Was present on blacklist at: 2024-10-25 15:43

Spamhaus SBL

193.111.248.144 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-20 15:43:20.073000
Was present on blacklist at: 2024-12-13 15:43, 2024-12-20 15:43

Warden events (7652)

2024-10-18: ReconScanning (node.4dc198): 119; ReconScanning (node.368407): 62
2024-10-17: ReconScanning (node.4dc198): 282; ReconScanning (node.368407): 107
2024-10-16: ReconScanning (node.4dc198): 285; ReconScanning (node.368407): 17
2024-10-15: ReconScanning (node.4dc198): 284; ReconScanning (node.368407): 12
2024-10-14: ReconScanning (node.4dc198): 285; ReconScanning (node.368407): 8
2024-10-13: ReconScanning (node.4dc198): 284
2024-10-12: ReconScanning (node.4dc198): 283
2024-10-11: ReconScanning (node.4dc198): 278
2024-10-10: ReconScanning (node.4dc198): 279
2024-10-09: ReconScanning (node.4dc198): 285; ReconScanning (node.368407): 1
2024-10-08: ReconScanning (node.4dc198): 285
2024-10-07: ReconScanning (node.4dc198): 285
2024-10-06: ReconScanning (node.4dc198): 278
2024-10-05: ReconScanning (node.4dc198): 286; ReconScanning (node.368407): 1
2024-10-04: ReconScanning (node.4dc198): 284
2024-10-03: ReconScanning (node.4dc198): 285
2024-10-02: ReconScanning (node.4dc198): 286
2024-10-01: ReconScanning (node.4dc198): 286
2024-09-30: ReconScanning (node.4dc198): 286
2024-09-29: ReconScanning (node.4dc198): 275
2024-09-28: ReconScanning (node.4dc198): 265
2024-09-27: ReconScanning (node.4dc198): 276
2024-09-26: ReconScanning (node.4dc198): 254
2024-09-25: ReconScanning (node.4dc198): 276
2024-09-24: ReconScanning (node.4dc198): 285
2024-09-23: ReconScanning (node.4dc198): 288
2024-09-22: ReconScanning (node.4dc198): 204
2024-09-21: ReconScanning (node.ce2b59): 15; ReconScanning (node.4dc198): 81

DShield reports (IP summary, reports)

2024-09-21: Number of reports: 2574; Distinct targets: 131
2024-09-22: Number of reports: 4319; Distinct targets: 159
2024-09-23: Number of reports: 2842; Distinct targets: 139
2024-09-24: Number of reports: 2597; Distinct targets: 137
2024-09-25: Number of reports: 2741; Distinct targets: 139
2024-09-26: Number of reports: 3155; Distinct targets: 115
2024-09-27: Number of reports: 2228; Distinct targets: 110
2024-09-28: Number of reports: 2986; Distinct targets: 113
2024-09-29: Number of reports: 3301; Distinct targets: 131
2024-09-30: Number of reports: 2101; Distinct targets: 111
2024-10-01: Number of reports: 3365; Distinct targets: 112
2024-10-02: Number of reports: 3228; Distinct targets: 121
2024-10-03: Number of reports: 3167; Distinct targets: 121
2024-10-04: Number of reports: 2839; Distinct targets: 123
2024-10-05: Number of reports: 4210; Distinct targets: 136
2024-10-06: Number of reports: 2707; Distinct targets: 134
2024-10-07: Number of reports: 3005; Distinct targets: 134
2024-10-08: Number of reports: 2495; Distinct targets: 117
2024-10-09: Number of reports: 3610; Distinct targets: 135
2024-10-10: Number of reports: 4018; Distinct targets: 125
2024-10-11: Number of reports: 4372; Distinct targets: 133
2024-10-12: Number of reports: 4762; Distinct targets: 145
2024-10-13: Number of reports: 5640; Distinct targets: 148
2024-10-14: Number of reports: 4601; Distinct targets: 139
2024-10-15: Number of reports: 4492; Distinct targets: 158
2024-10-16: Number of reports: 6161; Distinct targets: 160
2024-10-17: Number of reports: 7775; Distinct targets: 164
2024-10-18: Number of reports: 3790; Distinct targets: 83

OTX pulses

[5a7e3e70c44e7b48947593a7] 2018-02-10 00:36:00.396000 | Webscanners 2018-02-09 thru current day

Author name:	david3
Pulse modified:	2024-10-20 15:55:18.728000
Indicator created:	2024-09-20 16:20:20
Indicator role:	scanning_host
Indicator title:	404 NOT FOUND
Indicator expiration:	2024-12-19 00:00:00

[602bc528f447d628d41494f2] 2021-02-16 13:14:16.945000 | Ka's Honeypot visitors

Author name:	Kapppppa
Pulse modified:	2024-11-12 19:03:34.343000
Indicator created:	2024-10-13 23:35:01
Indicator role:	bruteforce
Indicator title:	Telnet Login attempt
Indicator expiration:	2024-11-12 23:00:00

[606d75c11c08ff94089a9430] 2021-04-07 09:05:05.353000 | Georgs Honeypot

Author name:	georgengelmann
Pulse modified:	2024-11-02 11:59:03.087000
Indicator created:	2024-10-03 13:49:03
Indicator role:	bruteforce
Indicator title:	Telnet intrusion attempt from tube-hosting.com port 35510
Indicator expiration:	2024-11-02 13:00:00

[6707e26cefff927bb382fea7] 2024-10-10 14:19:24.072000 | Telnet honeypot logs for 2024-10-10

Author name:	jnazario
Pulse modified:	2024-10-10 14:19:24.072000
Indicator created:	2024-10-10 14:19:25
Indicator role:	None
Indicator title:
Indicator expiration:	2024-11-09 14:00:00

[67111c97ea91cafc9d294488] 2024-10-17 14:17:59.604000 | Telnet honeypot logs for 2024-10-17

Author name:	jnazario
Pulse modified:	2024-10-17 14:17:59.604000
Indicator created:	2024-10-17 14:18:00
Indicator role:	None
Indicator title:
Indicator expiration:	2024-11-16 14:00:00

Origin AS: AS49581 - FerdinandZink
BGP Prefix: 193.111.248.0/24
geo: Germany, Frankfurt am Main; 🕑 Europe/Berlin
hostname: tube-hosting.com
Address block ('inetnum' or 'NetRange' in whois database): 193.111.248.0 - 193.111.248.255
last_activity: 2024-11-12 20:38:07.654000
last_warden_event: 2024-10-18 09:58:59
rep: 0.0
reserved_range: 0
Shodan's InternetDB: Open ports: 3389; Tags: self-signed; CPEs: –
ts_added: 2024-09-20 15:43:17.505000
ts_last_update: 2024-12-20 15:43:20.588000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses