IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

81.161.238.21 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-26 05:28:40.140000
Was present on blacklist at: 2024-10-24 05:28, 2024-10-31 05:28, 2024-11-07 05:28, 2024-11-14 05:28, 2024-11-21 05:28, 2024-11-28 05:28, 2024-12-05 05:28, 2024-12-12 05:28, 2024-12-19 05:28, 2024-12-26 05:28

Spamhaus DROP

81.161.238.21 is listed on the Spamhaus DROP blacklist.

Description: The Spamhaus DROP (Don't Route Or Peer) lists are advisory"drop all traffic" lists. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-26 05:28:40.140000
Was present on blacklist at: 2024-11-07 05:28, 2024-11-14 05:28, 2024-11-21 05:28, 2024-11-28 05:28, 2024-12-05 05:28, 2024-12-12 05:28, 2024-12-19 05:28, 2024-12-26 05:28

AbuseIPDB

81.161.238.21 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2024-12-01 05:00:00.325000
Was present on blacklist at: 2024-11-28 05:00, 2024-11-29 05:00, 2024-12-01 05:00

Turris greylist

81.161.238.21 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC,<br>which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2024-11-30 22:15:00.168000
Was present on blacklist at: 2024-11-30 22:15

Spamhaus XBL CBL

81.161.238.21 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-26 05:28:40.140000
Was present on blacklist at: 2024-12-05 05:28, 2024-12-12 05:28

Warden events (910)

2024-11-28: ReconScanning (node.4dc198): 212; ReconScanning (node.368407): 215; ReconScanning (node.ce2b59): 43; ReconScanning (node.5f02e7): 1
2024-11-27: ReconScanning (node.ce2b59): 38; ReconScanning (node.4dc198): 132; ReconScanning (node.368407): 130
2024-10-31: AnomalyTraffic (node.86dac8): 22
2024-10-30: AnomalyTraffic (node.86dac8): 17
2024-10-29: AnomalyTraffic (node.86dac8): 21
2024-10-28: AnomalyTraffic (node.86dac8): 22
2024-10-27: AnomalyTraffic (node.86dac8): 21
2024-10-26: AnomalyTraffic (node.86dac8): 22
2024-10-25: AnomalyTraffic (node.86dac8): 12
2024-10-24: AnomalyTraffic (node.ffe95c): 2

DShield reports (IP summary, reports)

2024-11-06: Number of reports: 57; Distinct targets: 28
2024-11-14: Number of reports: 265; Distinct targets: 182
2024-11-15: Number of reports: 32; Distinct targets: 20
2024-11-27: Number of reports: 1514; Distinct targets: 1154
2024-11-28: Number of reports: 2814; Distinct targets: 2002
2024-11-29: Number of reports: 2774; Distinct targets: 1629
2024-11-30: Number of reports: 210; Distinct targets: 112

Origin AS: AS401116 - NYBULA
BGP Prefix: 81.161.238.0/24
geo: Netherlands, Amsterdam; 🕑 Europe/Amsterdam
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 81.161.236.0 - 81.161.239.255
last_activity: 2024-11-28 17:52:07
last_warden_event: 2024-11-28 17:52:07
rep: 0.0
reserved_range: 0
Shodan's InternetDB: Open ports: 22; Tags: –; CPEs: cpe:/o:canonical:ubuntu_linux, cpe:/a:openbsd:openssh:8.2p1
ts_added: 2024-10-24 05:28:32.521000
ts_last_update: 2024-12-26 05:28:40.452000

Warden event timeline

DShield event timeline

Presence on blacklists