Search IP addresses by ...

IP prefix
IPv4 prefix/subnet in CIDR format.
Hostname suffix
Suffix of the hostname associated with the IP address. Can be used to search all hosts under given (sub)domain.
ASN
Autonomous system number. Enter as "1234" or "AS1234”.
Country
Code of the country the IP address is probably located in (according to MaxMind database).
Source
Select IP addresses for which there are data (alerts, events, ...) from given primary data source(s).
OR
AND
Event category
Select IP addresses with Warden alerts of given category.
OR
AND
Blacklist
Select IP addresses listed on given blacklist(s).
OR
AND
Tag
Select IP addresses with given tag(s).
OR
AND

Threat category

Role
Select IP addresses with threat category records matching the selected role.
Category
Select IP addresses with threat category records matching the selected category.
OR
AND
Subcategory
Select IP addresses with threat category records matching the selected subcategory.
=
Confidence
Minimum category confidence.

Sorting options

Sort by
Order
DESC
ASC
Max. number of addresses
IP addresses
Paste any text containing IPv4 addresses or prefixes in CIDR format. Search will return all addresses in NERD matching any of your addresses or prefixes.

Sorting options

Sort by
Order
DESC
ASC
Max. number of addresses

Results (≥20≥20)

IP address Hostname ASN Country Events Rep.(?) Threat category Other properties Time added Last activity Links
193.46.255.86 -- AS47890
RO 18434194
+ 145045 DShield reports 		0.991
src login protocol: ssh
port: 22, 2222
src scan port: 22
src —
10 blacklists  22, 2000scanner 2026-03-11 22:22:32 2026-10-23 08:11:11
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
176.53.159.196 -- AS154383
TR 43316162
+ 414594 DShield reports
+ 72 OTX pulses 		0.991
src login protocol: ssh
port: 22, 2222
src scan
3 blacklists  22 2026-07-01 15:29:24 2026-10-23 08:05:56
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
2.57.121.112 dns112.personaliseplus.com AS47890
RO 12286173
+ 133905 DShield reports
+ 2 OTX pulses 		0.986
src login protocol: ssh
port: 22, 2222
src scan port: 22
7 blacklists IP in hostname  22scanner 2025-10-04 21:56:26 2026-10-23 08:00:24
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
2.57.121.25 hosting25.tronicsat.com AS47890
RO 13414162
+ 140355 DShield reports
+ 2 OTX pulses 		0.984
src login protocol: ssh
port: 22, 2222
src scan port: 22, 23, 80, 443, 554, 5554, 8554, 32764, 37215
7 blacklists IP in hostname  22scanner 2025-10-05 10:37:13 2026-10-23 08:08:10
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
2.57.122.238 -- AS48090
AS47890
RO 16207204
+ 370125 DShield reports
+ 28 OTX pulses 		0.982
src login protocol: ssh
port: 22, 2222
src —
src scan port: 22
10 blacklists  80scanner 2025-11-06 15:20:09 2026-10-23 08:14:49
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
45.148.10.5 -- AS48090
NL 674383
+ 39559 DShield reports 		0.980
src scan port: 25, 80, 443, 465, 587
src login protocol: smtp
port: 25
17 blacklists  22, 5201scanner 2026-08-14 02:43:36 2026-10-23 08:15:59
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
93.152.221.108 -- AS197170
DE 7902174
+ 26095 DShield reports 		0.977
src scan port: many
src login protocol: ssh, telnet
port: 22, 23, 2222
src —
7 blacklists  22, 443, 843, 873, 887, ...scanner 2026-09-10 22:12:05 2026-10-23 08:11:19
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
179.43.133.154 hostedby.privatelayer.com AS51852
CH 42951122
+ 133004 DShield reports 		0.972
src login protocol: ssh
port: 22, 2222
src scan
3 blacklists  135, 137, 139, 5985, 10001, ... 2025-09-02 11:59:39 2026-10-23 08:14:49
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
102.220.161.86 -- AS197769
SI 6225134
+ 16520 DShield reports 		0.972
src login protocol: ssh, telnet
port: 22, 23, 2222
src scan port: many
9 blacklists Residential proxy  22, 887, 990, 1080, 1343, ...scanner 2026-09-10 21:31:09 2026-10-23 07:53:49
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
185.246.128.133 -- AS42237
SE 98146152
+ 199847 DShield reports 		0.968
src login protocol: ssh
port: 22, 2222
src scan
3 blacklists IP in hostname  135, 137, 445, 5985 2023-08-01 09:26:36 2026-10-23 08:06:59
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
152.32.225.117 -- AS135377
HK 60540133
+ 17397 DShield reports 		0.963
src scan port: 22, 23, 80, 443, 2222, 2375
src login protocol: ssh, telnet
port: 22, 23, 2222
13 blacklists  80, 3389, 7000, 8888self-signed 2026-10-09 09:32:25 2026-10-23 08:14:48
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
179.43.139.58 hostedby.privatelayer.com AS51852
CH 50224142
+ 359998 DShield reports 		0.961
src login protocol: ssh
port: 22, 2222
src scan
2 blacklists  135, 139, 445, 5985, 10000, ...eol-os 2025-09-02 11:57:48 2026-10-23 07:51:24
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
176.32.193.16 -- AS197834
AM 56801214
+ 107287 DShield reports
+ 18 OTX pulses 		0.960
src scan port: many
src —
src login protocol: ftp, rdp, redis, ssh
port: 21, 22, 2222
10 blacklists 2026-03-12 10:40:05 2026-10-23 08:15:59
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
195.178.110.228 -- AS48090
BG 4295144
+ 395322 DShield reports
+ 1 MISP events
+ 41 OTX pulses 		0.956
src login protocol: ssh
port: 22, 2222
src —
src scan port: 22
8 blacklists  22scanner 2026-06-24 23:55:25 2026-10-23 08:11:31
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
45.148.10.61 -- AS48090
NL 481573
+ 85839 DShield reports 		0.956
src —
src scan port: many
src login protocol: ssh
port: 22, 2222
8 blacklists  22, 80 2026-09-24 09:11:26 2026-10-23 08:14:39
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
45.198.224.119 -- AS215925
US 2360154
+ 10397 DShield reports
+ 1 OTX pulses 		0.955
src login protocol: ssh, telnet
port: 22, 23, 2222
src scan port: 18, 22, 23, 443, 2202, 2222, 24442, 36022
src botnet_drone
7 blacklists 2026-10-12 01:57:33 2026-10-23 08:14:50
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
93.152.221.37 -- AS197170
DE 4922164
+ 24472 DShield reports 		0.954
src scan port: many
src login protocol: ssh
port: 22, 2222
4 blacklists  22, 443, 887, 1013, 1023, ...scanner 2026-09-07 20:25:38 2026-10-23 08:11:21
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
160.250.132.238 -- AS150895
AS153439
VN 39608153
+ 24018 DShield reports 		0.949
src scan port: 22, 23, 80, 443, 2222, 2375
src login protocol: ssh, telnet
port: 22, 23, 2222
11 blacklists Residential proxy 2026-08-08 16:17:32 2026-10-23 08:14:45
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
192.248.150.180 192.248.150.180.vultrusercontent.com AS20473
GB 28231123
+ 106047 DShield reports
+ 12 OTX pulses 		0.947
src scan port: many
src —
src login protocol: ssh
port: 22, 2222
7 blacklists IP in hostname 2026-06-05 20:15:01 2026-10-23 08:15:59
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield
77.239.124.130 -- AS198364
NL 8539123
+ 136456 DShield reports
+ 26 OTX pulses 		0.946
src login protocol: ssh
port: 22, 2222
src —
src scan port: 22, 2222, 8022, 38322
5 blacklists  22scanner 2026-08-25 14:07:17 2026-10-23 08:12:20
  Shodan   Censys   valli.org   whatismyipaddress.com   AbuseIPDB   Talos Intelligence Center   Greynoise Visualizer   DShield