IP address

Passive DNS

Tags: Login attempts

IP blacklists

CI Army

213.202.230.251 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence<br>database that provides scores for IPs. Source of unspecified malicious attacks<br>most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2026-01-10 03:50:00.956000
Was present on blacklist at: 2025-12-29 03:50, 2025-12-30 03:50, 2025-12-31 03:50, 2026-01-01 03:50, 2026-01-02 03:50, 2026-01-03 03:50, 2026-01-04 03:50, 2026-01-05 03:50, 2026-01-06 03:50, 2026-01-08 03:50, 2026-01-09 03:50, 2026-01-10 03:50

Spamhaus SBL CSS

213.202.230.251 was recently listed on the Spamhaus SBL CSS blacklist, but currently it is not.

Description: The Spamhaus CSS is part of the SBL. CSS listings will have return code 127.0.0.3 to differentiate from regular SBL listings, which have return code 127.0.0.2.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-01-05 03:55:21.166000
Was present on blacklist at: 2025-12-29 03:55

Spamhaus XBL CBL

213.202.230.251 is listed on the Spamhaus XBL CBL blacklist.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-01-05 03:55:21.166000
Was present on blacklist at: 2025-12-29 03:55, 2026-01-05 03:55

DataPlane SSH login

213.202.230.251 is listed on the DataPlane SSH login blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds,<br>and measurement resource for operators, by operators. IPs trying<br>an unsolicited login to a host using SSH password authentication.
Type of feed: primary (feed detail page)

Last checked at: 2026-01-06 03:10:06.514000
Was present on blacklist at: 2025-12-30 03:10, 2025-12-30 07:10, 2025-12-30 15:10, 2025-12-30 19:10, 2025-12-31 03:10, 2025-12-31 07:10, 2025-12-31 15:10, 2025-12-31 19:10, 2026-01-01 03:10, 2026-01-01 07:10, 2026-01-01 15:10, 2026-01-01 19:10, 2026-01-02 03:10, 2026-01-02 07:10, 2026-01-02 15:10, 2026-01-02 19:10, 2026-01-03 03:10, 2026-01-03 07:10, 2026-01-03 15:10, 2026-01-03 19:10, 2026-01-04 03:10, 2026-01-04 07:10, 2026-01-04 15:10, 2026-01-04 19:10, 2026-01-05 03:10, 2026-01-05 07:10, 2026-01-05 15:10, 2026-01-06 03:10

Warden events (207)

2026-01-08: AttemptLogin (node.4dc198): 7
2026-01-07: AttemptLogin (node.4dc198): 54
2026-01-05: AttemptLogin (node.4dc198): 11
2026-01-04: AttemptLogin (node.4dc198): 61
2026-01-03: AttemptLogin (node.4dc198): 72
2025-12-30: AttemptLogin (node.4dc198): 2

DShield reports (IP summary, reports)

2025-12-28: Number of reports: 22; Distinct targets: 17
2025-12-29: Number of reports: 19; Distinct targets: 16
2025-12-30: Number of reports: 10; Distinct targets: 6
2025-12-31: Number of reports: 17; Distinct targets: 15
2026-01-01: Number of reports: 33; Distinct targets: 27
2026-01-02: Number of reports: 33; Distinct targets: 27
2026-01-03: Number of reports: 13; Distinct targets: 12
2026-01-04: Number of reports: 18; Distinct targets: 14
2026-01-06: Number of reports: 13; Distinct targets: 8

Origin AS: AS24961 - MYLOC-AS
BGP Prefix: 213.202.192.0/18
geo: Germany, Ühlingen-Birkendorf; 🕑 Europe/Berlin
hostname: srv50927.dus8.dedi.server-hosting.expert
Address block ('inetnum' or 'NetRange' in whois database): 213.202.192.0 - 213.202.255.255
last_activity: 2026-01-08 02:53:22
last_warden_event: 2026-01-08 02:53:22
rep: 0.20671502976190476
reserved_range: 0
Shodan's InternetDB: Open ports: 22, 8096; Tags: –; CPEs: cpe:/a:emby:emby.releases:4.9.1.90, cpe:/a:openbsd:openssh:9.6p1, cpe:/o:canonical:ubuntu_linux
ts_added: 2025-12-29 03:55:19.657000
ts_last_update: 2026-01-11 03:55:27.118000

Warden event timeline

DShield event timeline

Presence on blacklists