IP address

Passive DNS

Tags: Scanner

IP blacklists

Echelon TLS/SSL crawler

193.111.248.244 is listed on the Echelon TLS/SSL crawler blacklist.

Description: TLS/SSL connection fingerprinting detected via Suricata
Type of feed: primary (feed detail page)

Last checked at: 2026-06-05 09:40:00.402000
Was present on blacklist at: 2026-05-29 09:40, 2026-05-30 09:40, 2026-05-31 09:40, 2026-06-01 09:40, 2026-06-02 09:40, 2026-06-03 09:40, 2026-06-04 09:40, 2026-06-05 09:40

Echelon web crawler

193.111.248.244 is listed on the Echelon web crawler blacklist.

Description: HTTP web crawling activity detected on web honeypots
Type of feed: primary (feed detail page)

Last checked at: 2026-06-05 09:50:00.392000
Was present on blacklist at: 2026-05-29 09:50, 2026-05-30 09:50, 2026-05-31 09:50, 2026-06-01 09:50, 2026-06-02 09:50, 2026-06-03 09:50, 2026-06-04 09:50, 2026-06-05 09:50

blocklist.de bots

193.111.248.244 is listed on the blocklist.de bots blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs performing attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots.
Type of feed: primary (feed detail page)

Last checked at: 2026-06-02 16:05:00.229000
Was present on blacklist at: 2026-05-29 22:05, 2026-05-30 04:05, 2026-05-30 10:05, 2026-05-30 16:05, 2026-05-30 22:05, 2026-05-31 04:05, 2026-05-31 10:05, 2026-05-31 16:05, 2026-05-31 22:05, 2026-06-01 04:05, 2026-06-01 10:05, 2026-06-01 16:05, 2026-06-01 22:05, 2026-06-02 04:05, 2026-06-02 10:05, 2026-06-02 16:05

CI Army

193.111.248.244 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence database that provides scores for IPs. Source of unspecified malicious attacks most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2026-06-01 02:50:00.800000
Was present on blacklist at: 2026-05-30 02:50, 2026-05-31 02:50, 2026-06-01 02:50

AbuseIPDB

193.111.248.244 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc. Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-05-31 04:00:00.611000
Was present on blacklist at: 2026-05-30 04:00, 2026-05-31 04:00

Threat categories

TL	Role	Category	Details
50	src	scan	port: 80, 443, 9200

Warden events (134)

2026-06-04: ReconScanning (node.ce2b59): 13; ReconScanning (node.9c1411): 4
2026-06-03: ReconScanning (node.ce2b59): 14; ReconScanning (node.9c1411): 5
2026-06-02: ReconScanning (node.ce2b59): 12; ReconScanning (node.9c1411): 3
2026-06-01: ReconScanning (node.ce2b59): 8
2026-05-31: ReconScanning (node.ce2b59): 32
2026-05-30: ReconScanning (node.ce2b59): 18
2026-05-29: ReconScanning (node.ce2b59): 25

DShield reports (IP summary, reports)

2026-05-30: Number of reports: 153; Distinct targets: 51
2026-05-31: Number of reports: 106; Distinct targets: 38

Origin AS: AS49581 - FerdinandZink
BGP Prefix: 193.111.248.0/24
geo: Germany, Frankfurt am Main; 🕑 Europe/Berlin
hostname: tube-server.com
Address block ('inetnum' or 'NetRange' in whois database): 193.111.248.0 - 193.111.248.255
last_activity: 2026-06-04 14:42:41
last_warden_event: 2026-06-04 14:42:41
rep: 0.0032962566507798163
reserved_range: 0
ts_added: 2026-05-29 02:05:49.701000
ts_last_update: 2026-06-17 02:05:50.358000

Warden event timeline

DShield event timeline

Presence on blacklists