IP address

Search at other sites:
.37189.190.156.53gghs116-12l.org
Shodan(more info)
Passive DNS
Tags:
IP blacklists
Spamhaus SBL
89.190.156.53 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-05-21 05:08:33.945000
Was present on blacklist at: 2026-04-30 05:08, 2026-05-07 05:09, 2026-05-14 05:12, 2026-05-21 05:08
Spamhaus DROP
89.190.156.53 is listed on the Spamhaus DROP blacklist.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-05-21 05:08:33.945000
Was present on blacklist at: 2026-04-30 05:08, 2026-05-07 05:09, 2026-05-14 05:12, 2026-05-21 05:08
AbuseIPDB
89.190.156.53 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-05-18 04:00:00.739000
Was present on blacklist at: 2026-05-15 04:00, 2026-05-18 04:00
UCEPROTECT L1
89.190.156.53 is listed on the UCEPROTECT L1 blacklist.

Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed: primary (feed detail page)

Last checked at: 2026-05-24 07:45:00.618000
Was present on blacklist at: 2026-05-16 23:45, 2026-05-17 07:45, 2026-05-17 15:45, 2026-05-17 23:45, 2026-05-18 07:45, 2026-05-18 15:45, 2026-05-18 23:45, 2026-05-19 07:45, 2026-05-19 23:45, 2026-05-20 07:45, 2026-05-20 15:45, 2026-05-20 23:45, 2026-05-21 07:45, 2026-05-21 15:45, 2026-05-22 07:45, 2026-05-23 15:45, 2026-05-23 23:45, 2026-05-24 07:45
Echelon SIP register scanner
89.190.156.53 is listed on the Echelon SIP register scanner blacklist.

Description: SIP VoIP registration scanning on port 5060
Type of feed: primary (feed detail page)

Last checked at: 2026-05-24 09:30:00.280000
Was present on blacklist at: 2026-05-18 09:30, 2026-05-19 09:30, 2026-05-20 09:30, 2026-05-21 09:30, 2026-05-22 09:30, 2026-05-24 09:30

Threat categories

TLRoleCategoryDetails
35 src —
32 src scan port: 5060
Warden events (4)
2026-05-12
ReconScanning (node.ce2b59): 2
AnomalyTraffic (node.ce2b59): 2
DShield reports (IP summary, reports)
2026-04-29
Number of reports: 38
Distinct targets: 16
2026-04-30
Number of reports: 38
Distinct targets: 16
2026-05-09
Number of reports: 34
Distinct targets: 11
2026-05-10
Number of reports: 10
Distinct targets: 10
2026-05-13
Number of reports: 46
Distinct targets: 35
2026-05-14
Number of reports: 59
Distinct targets: 43
2026-05-15
Number of reports: 77
Distinct targets: 52
2026-05-16
Number of reports: 11
Distinct targets: 7
2026-05-17
Number of reports: 11
Distinct targets: 7
Origin AS
AS49870 - AS49870-BV
BGP Prefix
89.190.156.0/24
geo
Netherlands, Amsterdam
🕑 Europe/Amsterdam
hostname
gghs116-12l.org
Address block ('inetnum' or 'NetRange' in whois database)
89.190.156.0 - 89.190.159.255
last_activity
2026-05-12 17:38:03
last_warden_event
2026-05-12 17:38:03
rep
0.37111000027871954
reserved_range
0
ts_added
2026-04-30 05:08:07.652000
ts_last_update
2026-05-24 09:30:04.947000

Warden event timeline

DShield event timeline

Presence on blacklists