IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

93.123.85.130 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-19 05:16:34.834000
Was present on blacklist at: 2024-11-28 05:14, 2024-12-05 05:16, 2024-12-12 05:15, 2024-12-19 05:16

Spamhaus DROP

93.123.85.130 is listed on the Spamhaus DROP blacklist.

Description: The Spamhaus DROP (Don't Route Or Peer) lists are advisory"drop all traffic" lists. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2024-12-19 05:16:34.834000
Was present on blacklist at: 2024-11-28 05:14, 2024-12-05 05:16, 2024-12-12 05:15, 2024-12-19 05:16

Blocklist.net.ua

93.123.85.130 is listed on the Blocklist.net.ua blacklist.

Description: BlockList contains IP addresses that perform attacks, send spam or brute force passwords to the blocking list.
Type of feed: primary (feed detail page)

Last checked at: 2024-12-10 11:15:03.133000
Was present on blacklist at: 2024-11-28 07:15, 2024-11-28 11:15, 2024-11-28 15:15, 2024-11-28 19:15, 2024-11-28 23:15, 2024-11-29 03:15, 2024-11-29 11:15, 2024-11-29 15:15, 2024-11-29 19:15, 2024-11-29 23:15, 2024-11-30 03:15, 2024-11-30 07:15, 2024-12-09 15:15, 2024-12-09 19:15, 2024-12-09 23:15, 2024-12-10 03:15, 2024-12-10 07:15, 2024-12-10 11:15

DataPlane SSH conn

93.123.85.130 is listed on the DataPlane SSH conn blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. IP addresses that has been seen initiating an unsolicited SSH connection to a remote host.
Type of feed: primary (feed detail page)

Last checked at: 2024-12-14 03:10:01.791000
Was present on blacklist at: 2024-11-28 11:10, 2024-11-28 15:10, 2024-11-28 19:10, 2024-11-28 23:10, 2024-11-29 03:10, 2024-11-29 07:10, 2024-11-29 11:10, 2024-11-29 15:10, 2024-11-29 19:10, 2024-11-29 23:10, 2024-11-30 03:10, 2024-11-30 07:10, 2024-11-30 11:10, 2024-11-30 15:10, 2024-11-30 19:10, 2024-11-30 23:10, 2024-12-01 03:10, 2024-12-01 07:10, 2024-12-01 11:10, 2024-12-01 15:10, 2024-12-01 19:10, 2024-12-01 23:10, 2024-12-02 03:10, 2024-12-02 07:10, 2024-12-02 11:10, 2024-12-02 15:10, 2024-12-02 19:10, 2024-12-02 23:10, 2024-12-03 03:10, 2024-12-03 07:10, 2024-12-03 11:10, 2024-12-03 15:10, 2024-12-03 19:10, 2024-12-04 03:10, 2024-12-04 07:10, 2024-12-04 11:10, 2024-12-04 15:10, 2024-12-04 19:10, 2024-12-04 23:10, 2024-12-05 03:10, 2024-12-05 07:10, 2024-12-05 11:10, 2024-12-05 15:10, 2024-12-05 19:10, 2024-12-05 23:10, 2024-12-06 03:10, 2024-12-06 07:10, 2024-12-06 11:10, 2024-12-06 15:10, 2024-12-06 19:10, 2024-12-06 23:10, 2024-12-07 03:10, 2024-12-07 07:10, 2024-12-07 11:10, 2024-12-07 15:10, 2024-12-07 19:10, 2024-12-07 23:10, 2024-12-08 03:10, 2024-12-08 07:10, 2024-12-08 11:10, 2024-12-08 15:10, 2024-12-08 19:10, 2024-12-08 23:10, 2024-12-09 03:10, 2024-12-09 07:10, 2024-12-09 11:10, 2024-12-09 15:10, 2024-12-09 19:10, 2024-12-09 23:10, 2024-12-10 03:10, 2024-12-10 07:10, 2024-12-10 11:10, 2024-12-10 15:10, 2024-12-10 19:10, 2024-12-10 23:10, 2024-12-11 03:10, 2024-12-11 07:10, 2024-12-11 11:10, 2024-12-11 15:10, 2024-12-11 19:10, 2024-12-11 23:10, 2024-12-12 03:10, 2024-12-12 07:10, 2024-12-12 11:10, 2024-12-12 15:10, 2024-12-12 19:10, 2024-12-12 23:10, 2024-12-13 03:10, 2024-12-13 07:10, 2024-12-13 11:10, 2024-12-13 15:10, 2024-12-13 19:10, 2024-12-13 23:10, 2024-12-14 03:10

Turris greylist

93.123.85.130 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC, which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2024-12-11 22:15:00.323000
Was present on blacklist at: 2024-11-29 22:15, 2024-12-01 22:15, 2024-12-07 22:15, 2024-12-08 22:15, 2024-12-10 22:15, 2024-12-11 22:15

AbuseIPDB

93.123.85.130 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc. Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2024-12-18 05:00:00.580000
Was present on blacklist at: 2024-12-18 05:00

Warden events (679)

2024-12-18: ReconScanning (node.ce2b59): 5
2024-12-09: IntrusionUserCompromise (node.cfb4f7): 446; ReconScanning (node.ce2b59): 2; ReconScanning (node.4dc198): 4
2024-12-08: ReconScanning (node.ce2b59): 2; IntrusionUserCompromise (node.cfb4f7): 1
2024-12-07: ReconScanning (node.ce2b59): 14; ReconScanning (node.4dc198): 33
2024-12-06: ReconScanning (node.4dc198): 1; ReconScanning (node.ce2b59): 4; IntrusionUserCompromise (node.cfb4f7): 4
2024-12-05: ReconScanning (node.4dc198): 97; ReconScanning (node.ce2b59): 19; IntrusionUserCompromise (node.cfb4f7): 1
2024-12-04: ReconScanning (node.4dc198): 4; ReconScanning (node.ce2b59): 1
2024-12-03: IntrusionUserCompromise (node.cfb4f7): 1
2024-12-01: ReconScanning (node.ce2b59): 2; ReconScanning (node.4dc198): 1
2024-11-30: ReconScanning (node.ce2b59): 9
2024-11-29: ReconScanning (node.ce2b59): 1
2024-11-28: ReconScanning (node.ce2b59): 19; IntrusionUserCompromise (node.cfb4f7): 5; ReconScanning (node.4dc198): 3

DShield reports (IP summary, reports)

2024-11-28: Number of reports: 103; Distinct targets: 14
2024-11-29: Number of reports: 210; Distinct targets: 12
2024-11-30: Number of reports: 51; Distinct targets: 22
2024-12-04: Number of reports: 11; Distinct targets: 8
2024-12-05: Number of reports: 155; Distinct targets: 111
2024-12-06: Number of reports: 29; Distinct targets: 9
2024-12-07: Number of reports: 138; Distinct targets: 65
2024-12-09: Number of reports: 174; Distinct targets: 19
2024-12-10: Number of reports: 971; Distinct targets: 59
2024-12-18: Number of reports: 26; Distinct targets: 8

Origin AS: AS216240 -
BGP Prefix: 93.123.85.0/24
geo: Bulgaria; 🕑 Europe/Sofia
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 93.123.84.0 - 93.123.85.255
last_activity: 2024-12-18 06:33:09
last_warden_event: 2024-12-18 06:33:09
rep: 0.04151785714285715
reserved_range: 0
Shodan's InternetDB: Open ports: 22; Tags: scanner; CPEs: cpe:/o:canonical:ubuntu_linux, cpe:/a:openbsd:openssh:8.9p1
ts_added: 2024-11-28 05:14:55.910000
ts_last_update: 2024-12-23 05:19:17.546000

Warden event timeline

DShield event timeline

Presence on blacklists