IP address


.94591.245.74.31
Shodan(more info)
Passive DNS
Tags: Residential proxy
IP blacklists
AbuseIPDB
91.245.74.31 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-09-06 04:00:00.693000
Was present on blacklist at: 2026-09-02 04:00, 2026-09-03 04:00, 2026-09-04 04:00, 2026-09-05 04:00, 2026-09-06 04:00
Spamhaus PBL ISP
91.245.74.31 is listed on the Spamhaus PBL ISP blacklist.

Description: The Spamhaus PBL is a DNSBL database of end-user IP address ranges which should not be delivering unauthenticated SMTP email to any Internet mail server except those provided for specifically by an ISP for that customer's use.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-09-02 04:00:24.125000
Was present on blacklist at: 2026-09-02 04:00
blocklist.de bots
91.245.74.31 is listed on the blocklist.de bots blacklist.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing attacks on the RFI-Attacks,<br>REG-Bots, IRC-Bots or BadBots.
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 16:05:00.427000
Was present on blacklist at: 2026-09-02 04:05, 2026-09-02 10:05, 2026-09-02 16:05, 2026-09-02 22:05, 2026-09-03 04:05, 2026-09-03 10:05, 2026-09-03 16:05, 2026-09-03 22:05, 2026-09-04 04:05, 2026-09-04 22:05, 2026-09-05 04:05, 2026-09-05 10:05, 2026-09-05 16:05, 2026-09-05 22:05, 2026-09-06 04:05, 2026-09-06 10:05, 2026-09-06 22:05, 2026-09-07 10:05, 2026-09-07 16:05
Echelon config file hunt
91.245.74.31 is listed on the Echelon config file hunt blacklist.

Description: Scanning for exposed configuration files
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:10:00.451000
Was present on blacklist at: 2026-09-02 09:10, 2026-09-03 09:10, 2026-09-04 09:10, 2026-09-05 09:10, 2026-09-06 09:10, 2026-09-07 09:10
Echelon TLS/SSL crawler
91.245.74.31 is listed on the Echelon TLS/SSL crawler blacklist.

Description: TLS/SSL connection fingerprinting detected via Suricata
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:40:00.614000
Was present on blacklist at: 2026-09-02 09:40, 2026-09-03 09:40, 2026-09-04 09:40, 2026-09-05 09:40, 2026-09-06 09:40, 2026-09-07 09:40
Echelon web crawler
91.245.74.31 is listed on the Echelon web crawler blacklist.

Description: HTTP web crawling activity detected on web honeypots
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:50:00.431000
Was present on blacklist at: 2026-09-02 09:50, 2026-09-03 09:50, 2026-09-04 09:50, 2026-09-05 09:50, 2026-09-06 09:50, 2026-09-07 09:50
Echelon CGI script hunt
91.245.74.31 is listed on the Echelon CGI script hunt blacklist.

Description: Scanning for vulnerable CGI scripts
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:05:02.048000
Was present on blacklist at: 2026-09-03 09:05, 2026-09-04 09:05, 2026-09-05 09:05, 2026-09-06 09:05, 2026-09-07 09:05
Echelon CMS enumeration
91.245.74.31 is listed on the Echelon CMS enumeration blacklist.

Description: Content management system discovery and enumeration
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:05:01.909000
Was present on blacklist at: 2026-09-03 09:05, 2026-09-04 09:05, 2026-09-05 09:05, 2026-09-06 09:05, 2026-09-07 09:05
Echelon admin panel hunt
91.245.74.31 is listed on the Echelon admin panel hunt blacklist.

Description: Scanning for administrative interfaces
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:05:04.485000
Was present on blacklist at: 2026-09-03 09:05, 2026-09-04 09:05, 2026-09-05 09:05, 2026-09-06 09:05, 2026-09-07 09:05
Echelon database admin hunt
91.245.74.31 is listed on the Echelon database admin hunt blacklist.

Description: Scanning for database admin interfaces (phpMyAdmin, etc.)
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:10:00.311000
Was present on blacklist at: 2026-09-03 09:10, 2026-09-04 09:10, 2026-09-05 09:10, 2026-09-06 09:10, 2026-09-07 09:10
Echelon file upload
91.245.74.31 is listed on the Echelon file upload blacklist.

Description: Attempting to upload potentially malicious files
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:15:00.379000
Was present on blacklist at: 2026-09-03 09:15, 2026-09-04 09:15, 2026-09-05 09:15, 2026-09-06 09:15, 2026-09-07 09:15
Echelon router exploit
91.245.74.31 is listed on the Echelon router exploit blacklist.

Description: Attempting router firmware exploits (Netgear, D-Link, etc.)
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:30:00.377000
Was present on blacklist at: 2026-09-03 09:30, 2026-09-04 09:30, 2026-09-05 09:30, 2026-09-06 09:30, 2026-09-07 09:30
Echelon web shell hunt
91.245.74.31 is listed on the Echelon web shell hunt blacklist.

Description: Scanning for web shells (WSO, c99, r57, etc.)
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:50:00.396000
Was present on blacklist at: 2026-09-03 09:50, 2026-09-04 09:50, 2026-09-05 09:50, 2026-09-06 09:50, 2026-09-07 09:50
Echelon WordPress enumeration
91.245.74.31 is listed on the Echelon WordPress enumeration blacklist.

Description: WordPress user and plugin enumeration
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:55:00.264000
Was present on blacklist at: 2026-09-03 09:55, 2026-09-04 09:55, 2026-09-05 09:55, 2026-09-06 09:55, 2026-09-07 09:55
UCEPROTECT L1
91.245.74.31 is listed on the UCEPROTECT L1 blacklist.

Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 15:45:00.767000
Was present on blacklist at: 2026-09-03 23:45, 2026-09-04 07:45, 2026-09-04 15:45, 2026-09-04 23:45, 2026-09-05 07:45, 2026-09-05 15:45, 2026-09-05 23:45, 2026-09-06 07:45, 2026-09-06 23:45, 2026-09-07 15:45
Echelon directory traversal
91.245.74.31 is listed on the Echelon directory traversal blacklist.

Description: Path traversal attack attempting to access restricted files
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:15:00.354000
Was present on blacklist at: 2026-09-07 09:15
Echelon port scan
91.245.74.31 is listed on the Echelon port scan blacklist.

Description: Scanning 5+ ports on target host
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:25:00.730000
Was present on blacklist at: 2026-09-07 09:25
Echelon SQL injection
91.245.74.31 is listed on the Echelon SQL injection blacklist.

Description: None
Type of feed: primary (feed detail page)

Last checked at: 2026-09-07 09:30:00.308000
Was present on blacklist at: 2026-09-07 09:30

Threat categories

TLRoleCategoryDetails
75 src scan port: 80, 443
48 src
40 src exploit protocol: http

Warden events (66)
2026-09-07
ReconScanning (node.ce2b59): 2
2026-09-05
ReconScanning (node.ce2b59): 10
ReconScanning (node.9c1411): 23
2026-09-04
ReconScanning (node.ce2b59): 12
ReconScanning (node.9c1411): 19
DShield reports (IP summary, reports)
2026-09-03
Number of reports: 59697
Distinct targets: 90
2026-09-04
Number of reports: 396
Distinct targets: 107
2026-09-05
Number of reports: 254
Distinct targets: 73
2026-09-06
Number of reports: 24
Distinct targets: 6
Residential proxy info (data provided by Layer3 Intel)
Last seen: 2026-09-05 02:22:55}
Percent days seen: 10 %
Networks: ANYIP, BYTEPROXIES, DATAIMPULSE, PROXY4U, RESIPROXIES
Details: https://layer3intel.com/context/91.245.74.31
Origin AS
AS49824 - ACTPA-AS
BGP Prefix
91.245.72.0/21
geo
Ukraine, Lviv
🕑 Europe/Kyiv
hostname
(null)
Address block ('inetnum' or 'NetRange' in whois database)
91.245.72.0 - 91.245.79.255
last_activity
2026-09-07 07:06:27
last_warden_event
2026-09-07 07:06:27
rep
0.9454619335145423
reserved_range
0
Shodan's InternetDB
Open ports: 21, 22, 80, 110, 143, 443, 995, 3000, 3001, 3021, 3478, 6001, 6002, 8443, 20000
Tags: self-signed, starttls
CPEs: cpe:/a:nodejs:node.js, cpe:/a:f5:nginx, cpe:/a:openbsd:openssh:8.7, cpe:/a:expressjs:express, cpe:/a:apache:http_server
ts_added
2026-09-02 04:00:23.928000
ts_last_update
2026-09-07 16:43:56.824000

Warden event timeline

DShield event timeline

Presence on blacklists