IP address

Passive DNS

Tags: Scanner

IP blacklists

blocklist.de SSH

207.154.235.81 is listed on the blocklist.de SSH blacklist.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing SSH attacks.
Type of feed: primary (feed detail page)

Last checked at: 2024-05-06 10:05:00.611000
Was present on blacklist at: 2024-05-03 22:05, 2024-05-04 04:05, 2024-05-04 10:05, 2024-05-04 16:05, 2024-05-04 22:05, 2024-05-05 04:05, 2024-05-05 10:05, 2024-05-05 16:05, 2024-05-05 22:05, 2024-05-06 04:05, 2024-05-06 10:05

DataPlane SSH login

207.154.235.81 is listed on the DataPlane SSH login blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds,<br>and measurement resource for operators, by operators. IPs performing<br>login to a host using SSH password authentication.
Type of feed: primary (feed detail page)

Last checked at: 2024-05-11 10:10:01.274000
Was present on blacklist at: 2024-05-04 02:10, 2024-05-04 06:10, 2024-05-04 10:10, 2024-05-04 14:10, 2024-05-04 18:10, 2024-05-04 22:10, 2024-05-05 02:10, 2024-05-05 06:10, 2024-05-05 10:10, 2024-05-05 14:10, 2024-05-05 18:10, 2024-05-05 22:10, 2024-05-06 02:10, 2024-05-06 06:10, 2024-05-06 10:10, 2024-05-06 14:10, 2024-05-06 18:10, 2024-05-06 22:10, 2024-05-07 02:10, 2024-05-07 06:10, 2024-05-07 10:10, 2024-05-07 14:10, 2024-05-07 18:10, 2024-05-07 22:10, 2024-05-08 02:10, 2024-05-08 06:10, 2024-05-08 10:10, 2024-05-08 14:10, 2024-05-08 18:10, 2024-05-08 22:10, 2024-05-09 02:10, 2024-05-09 06:10, 2024-05-09 10:10, 2024-05-09 14:10, 2024-05-09 18:10, 2024-05-09 22:10, 2024-05-10 02:10, 2024-05-10 06:10, 2024-05-10 10:10, 2024-05-10 14:10, 2024-05-10 18:10, 2024-05-10 22:10, 2024-05-11 02:10, 2024-05-11 06:10, 2024-05-11 10:10

AbuseIPDB

207.154.235.81 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>IPs performing malicious activity(DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2024-05-15 04:00:00.600000
Was present on blacklist at: 2024-05-05 04:00, 2024-05-15 04:00

UCEPROTECT L1

207.154.235.81 is listed on the UCEPROTECT L1 blacklist.

Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed: primary (feed detail page)

Last checked at: 2024-05-17 15:45:00.879000
Was present on blacklist at: 2024-05-10 23:45, 2024-05-11 07:45, 2024-05-11 15:45, 2024-05-11 23:45, 2024-05-12 07:45, 2024-05-12 15:45, 2024-05-12 23:45, 2024-05-13 07:45, 2024-05-13 15:45, 2024-05-13 23:45, 2024-05-14 07:45, 2024-05-14 15:45, 2024-05-14 23:45, 2024-05-15 07:45, 2024-05-15 15:45, 2024-05-15 23:45, 2024-05-16 07:45, 2024-05-16 15:45, 2024-05-16 23:45, 2024-05-17 07:45, 2024-05-17 15:45

Warden events (66)

2024-05-18: ReconScanning (node.7d83c0): 1
2024-05-17: ReconScanning (node.7d83c0): 6
2024-05-16: ReconScanning (node.7d83c0): 6
2024-05-15: ReconScanning (node.7d83c0): 2
2024-05-14: ReconScanning (node.7d83c0): 3
2024-05-13: ReconScanning (node.7d83c0): 2
2024-05-12: ReconScanning (node.7d83c0): 6
2024-05-11: ReconScanning (node.7d83c0): 5
2024-05-10: ReconScanning (node.7d83c0): 7
2024-05-09: ReconScanning (node.7d83c0): 6
2024-05-08: ReconScanning (node.7d83c0): 6
2024-05-07: ReconScanning (node.7d83c0): 5
2024-05-06: ReconScanning (node.7d83c0): 5
2024-05-05: ReconScanning (node.7d83c0): 2
2024-05-04: ReconScanning (node.7d83c0): 3; AttemptLogin (node.f6f462): 1

DShield reports (IP summary, reports)

2024-05-04: Number of reports: 260; Distinct targets: 5
2024-05-05: Number of reports: 11; Distinct targets: 5

OTX pulses

[663e2de42e11d75dd0ea698e] 2024-05-10 14:23:32.937000 | SSH honeypot logs for 2024-05-10

Author name:	jnazario
Pulse modified:	2024-05-10 14:23:32.937000
Indicator created:	2024-05-10 14:23:33
Indicator role:	None
Indicator title:
Indicator expiration:	2024-06-09 14:00:00

Origin AS: AS14061 - DIGITALOCEAN-ASN
BGP Prefix: 207.154.224.0/20
geo: Germany, Frankfurt am Main; 🕑 Europe/Berlin
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 207.154.192.0 - 207.154.255.255
last_activity: 2024-05-18 00:48:39
last_warden_event: 2024-05-18 00:48:39
rep: 0.43058035714285714
reserved_range: 0
Shodan's InternetDB: Open ports: 22, 80, 88, 104, 135, 631, 1024, 1515, 1521, 1723, 1741, 1800, 1801, 1911, 1925, 1935, 2000, 2404, 3128, 3333, 3541, 3542, 4000, 4040, 4242, 5000, 5009, 5201, 5222, 5435, 5601, 5801, 5900, 5901, 6000, 6001, 7415, 8008, 8010, 8080, 8112, 8123, 8200, 8800, 9009, 9100, 9200, 9418, 9530, 9600, 9633; Tags: cloud; CPEs: cpe:/a:openbsd:openssh
ts_added: 2024-05-03 22:09:55.665000
ts_last_update: 2024-05-18 00:54:15.803000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses