IP address

Passive DNS

Tags: IP in hostname

IP blacklists: Echelon config file hunt
52.85.209.70 is listed on the Echelon config file hunt blacklist.

Description: Scanning for exposed configuration files
Type of feed: primary (feed detail page)

Last checked at: 2026-07-06 09:10:00.356000
Was present on blacklist at: 2026-07-02 09:10, 2026-07-03 09:10, 2026-07-04 09:10, 2026-07-05 09:10, 2026-07-06 09:10
Echelon web shell hunt
52.85.209.70 is listed on the Echelon web shell hunt blacklist.

Description: Scanning for web shells (WSO, c99, r57, etc.)
Type of feed: primary (feed detail page)

Last checked at: 2026-07-06 09:50:00.311000
Was present on blacklist at: 2026-07-03 09:50, 2026-07-04 09:50, 2026-07-05 09:50, 2026-07-06 09:50
Echelon web crawler
52.85.209.70 is listed on the Echelon web crawler blacklist.

Description: HTTP web crawling activity detected on web honeypots
Type of feed: primary (feed detail page)

Last checked at: 2026-07-06 09:50:00.548000
Was present on blacklist at: 2026-07-03 09:50, 2026-07-04 09:50, 2026-07-05 09:50, 2026-07-06 09:50

TL	Role	Category	Details
41	src	scan

Origin AS: AS16509 - AMAZON-02
BGP Prefix: 52.85.208.0/23
geo: United States; 🕑 America/Chicago
hostname: server-52-85-209-70.bog51.r.cloudfront.net
hostname_class: ['ip_in_hostname']
Address block ('inetnum' or 'NetRange' in whois database): 52.84.0.0 - 52.87.255.255
rep: 0.4053964424986395
reserved_range: 0
Shodan's InternetDB: Open ports: 80; Tags: cdn, cloud; CPEs: cpe:/a:amazon:amazon_cloudfront
ts_added: 2026-07-02 09:10:06.983000
ts_last_update: 2026-07-06 09:50:15.659000

Warden event timeline

DShield event timeline

Presence on blacklists