IP address

Passive DNS

Tags:

IP blacklists

Spamhaus XBL CBL

94.26.0.103 is listed on the Spamhaus XBL CBL blacklist.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-11-03 05:06:45.695000
Was present on blacklist at: 2026-10-06 05:03, 2026-10-13 05:11, 2026-10-20 05:06, 2026-10-27 06:01, 2026-11-03 05:06

AbuseIPDB

94.26.0.103 was recently listed on the AbuseIPDB blacklist, but currently it is not.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-10-31 05:00:00.664000
Was present on blacklist at: 2026-10-08 04:00, 2026-10-10 04:00, 2026-10-12 04:00, 2026-10-19 04:00, 2026-10-20 04:00, 2026-10-22 04:00, 2026-10-23 04:00, 2026-10-27 05:00, 2026-10-29 05:00, 2026-10-31 05:00

Spamhaus SBL

94.26.0.103 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-11-03 05:06:45.695000
Was present on blacklist at: 2026-10-13 05:11, 2026-10-20 05:06, 2026-10-27 06:01, 2026-11-03 05:06

Spamhaus DROP

94.26.0.103 is listed on the Spamhaus DROP blacklist.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-11-03 05:06:45.695000
Was present on blacklist at: 2026-10-13 05:11, 2026-10-20 05:06, 2026-10-27 06:01, 2026-11-03 05:06

blocklist.de bots

94.26.0.103 was recently listed on the blocklist.de bots blacklist, but currently it is not.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing attacks on the RFI-Attacks,<br>REG-Bots, IRC-Bots or BadBots.
Type of feed: primary (feed detail page)

Last checked at: 2026-11-02 05:05:00.429000
Was present on blacklist at: 2026-10-21 22:05, 2026-10-22 04:05, 2026-10-22 10:05, 2026-10-22 16:05, 2026-10-22 22:05, 2026-10-23 04:05, 2026-10-23 10:05, 2026-10-23 16:05, 2026-10-26 23:05, 2026-10-27 05:05, 2026-10-27 11:05, 2026-10-27 17:05, 2026-10-27 23:05, 2026-10-28 05:05, 2026-10-28 11:05, 2026-10-28 17:05, 2026-10-31 11:05, 2026-10-31 17:05, 2026-10-31 23:05, 2026-11-01 05:05, 2026-11-01 11:05, 2026-11-01 17:05, 2026-11-01 23:05, 2026-11-02 05:05

Echelon TLS/SSL crawler

94.26.0.103 was recently listed on the Echelon TLS/SSL crawler blacklist, but currently it is not.

Description: IPs detected by Echelon sensors (honeypots) as performing this activity: TLS/SSL connection fingerprinting detected via Suricata
Type of feed: primary (feed detail page)

Last checked at: 2026-11-01 10:40:00.679000
Was present on blacklist at: 2026-10-25 10:40, 2026-10-26 10:40, 2026-10-27 10:40, 2026-10-28 10:40, 2026-10-29 10:40, 2026-10-30 10:40, 2026-10-31 10:40, 2026-11-01 10:40

Threat categories

TL	Role	Category	Details
84	src	scan	port: many
38	src	—

Warden events (321)

2026-11-01: ReconScanning (node.ce2b59): 20; ReconScanning (node.368407): 3; ReconScanning (node.4dc198): 2
2026-10-31: ReconScanning (node.ce2b59): 31
2026-10-30: ReconScanning (node.ce2b59): 31
2026-10-29: ReconScanning (node.ce2b59): 31
2026-10-28: ReconScanning (node.ce2b59): 31
2026-10-27: ReconScanning (node.ce2b59): 31
2026-10-26: ReconScanning (node.ce2b59): 31
2026-10-25: ReconScanning (node.ce2b59): 30
2026-10-24: ReconScanning (node.ce2b59): 31
2026-10-23: ReconScanning (node.ce2b59): 31
2026-10-22: ReconScanning (node.ce2b59): 18

DShield reports (IP summary, reports)

2026-10-05: Number of reports: 326; Distinct targets: 34
2026-10-06: Number of reports: 392; Distinct targets: 70
2026-10-07: Number of reports: 586; Distinct targets: 76
2026-10-08: Number of reports: 798; Distinct targets: 72
2026-10-09: Number of reports: 589; Distinct targets: 66
2026-10-10: Number of reports: 757; Distinct targets: 74
2026-10-11: Number of reports: 695; Distinct targets: 75
2026-10-12: Number of reports: 911; Distinct targets: 78
2026-10-14: Number of reports: 836; Distinct targets: 59
2026-10-15: Number of reports: 855; Distinct targets: 72
2026-10-16: Number of reports: 171; Distinct targets: 43
2026-10-18: Number of reports: 180; Distinct targets: 44
2026-10-19: Number of reports: 180; Distinct targets: 44
2026-10-20: Number of reports: 164; Distinct targets: 51
2026-10-21: Number of reports: 332; Distinct targets: 53
2026-10-24: Number of reports: 261; Distinct targets: 72
2026-10-25: Number of reports: 258; Distinct targets: 62
2026-10-26: Number of reports: 298; Distinct targets: 52
2026-10-27: Number of reports: 353; Distinct targets: 54
2026-10-28: Number of reports: 353; Distinct targets: 54
2026-10-29: Number of reports: 279; Distinct targets: 61
2026-10-30: Number of reports: 279; Distinct targets: 61
2026-10-31: Number of reports: 276; Distinct targets: 65
2026-11-01: Number of reports: 319; Distinct targets: 51

Origin AS: AS135388 - RPL-HK
BGP Prefix: 94.26.0.0/24
geo: Germany; 🕑 Europe/Berlin
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 94.26.0.0 - 94.26.3.255
last_activity: 2026-11-01 14:56:30
last_warden_event: 2026-11-01 14:56:30
rep: 0.5414137470062692
reserved_range: 0
ts_added: 2026-10-06 05:03:14.984000
ts_last_update: 2026-11-03 05:06:45.787000

Warden event timeline

DShield event timeline

Presence on blacklists