IP address

Search at other sites:

.172103.244.227.48undefined.hostname.localhost

Shodan(more info)

Passive DNS

IP blacklists

AbuseIPDB

103.244.227.48 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-08-01 04:00:00.568000
Was present on blacklist at: 2026-06-24 04:00, 2026-07-03 04:00, 2026-07-10 04:00, 2026-08-01 04:00

Echelon TLS/SSL crawler

103.244.227.48 is listed on the Echelon TLS/SSL crawler blacklist.

Description: TLS/SSL connection fingerprinting detected via Suricata
Type of feed: primary (feed detail page)

Last checked at: 2026-07-20 09:40:00.404000
Was present on blacklist at: 2026-07-01 09:40, 2026-07-02 09:40, 2026-07-03 09:40, 2026-07-04 09:40, 2026-07-05 09:40, 2026-07-06 09:40, 2026-07-07 09:40, 2026-07-08 09:40, 2026-07-14 09:40, 2026-07-15 09:40, 2026-07-16 09:40, 2026-07-17 09:40, 2026-07-18 09:40, 2026-07-19 09:40, 2026-07-20 09:40

Echelon web crawler

103.244.227.48 is listed on the Echelon web crawler blacklist.

Description: HTTP web crawling activity detected on web honeypots
Type of feed: primary (feed detail page)

Last checked at: 2026-08-07 09:50:00.452000
Was present on blacklist at: 2026-07-01 09:50, 2026-07-03 09:50, 2026-07-04 09:50, 2026-07-05 09:50, 2026-07-06 09:50, 2026-07-07 09:50, 2026-07-08 09:50, 2026-07-14 09:50, 2026-07-15 09:50, 2026-07-16 09:50, 2026-07-17 09:50, 2026-07-18 09:50, 2026-07-19 09:50, 2026-07-20 09:50, 2026-08-05 09:50, 2026-08-06 09:50, 2026-08-07 09:50

Echelon SSH connection attempt

103.244.227.48 is listed on the Echelon SSH connection attempt blacklist.

Description: SSH connection attempt detected on port 22 or 2222
Type of feed: primary (feed detail page)

Last checked at: 2026-07-14 09:35:00.439000
Was present on blacklist at: 2026-07-08 09:35, 2026-07-09 09:35, 2026-07-10 09:35, 2026-07-11 09:35, 2026-07-12 09:35, 2026-07-13 09:35, 2026-07-14 09:35

CI Army

103.244.227.48 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence<br>database that provides scores for IPs. Source of unspecified malicious attacks<br>most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2026-07-28 02:50:00.814000
Was present on blacklist at: 2026-07-28 02:50

Threat categories

TL	Role	Category	Details
39	src	scan	port: 500, 4500, 5000, 5500
25	src	—

---

Warden events (39)

2026-07-28

ReconScanning (node.ce2b59): 19

2026-07-27

ReconScanning (node.ce2b59): 20

DShield reports (IP summary, reports)

2026-06-06

Number of reports: 29

Distinct targets: 12

2026-06-07

Number of reports: 29

Distinct targets: 12

2026-06-08

Number of reports: 23

Distinct targets: 8

2026-06-09

Number of reports: 22

Distinct targets: 7

2026-06-10

Number of reports: 22

Distinct targets: 7

2026-06-12

Number of reports: 45

Distinct targets: 16

2026-06-13

Number of reports: 45

Distinct targets: 16

2026-06-14

Number of reports: 41

Distinct targets: 14

2026-06-16

Number of reports: 16

Distinct targets: 7

2026-06-18

Number of reports: 21

Distinct targets: 10

2026-06-19

Number of reports: 15

Distinct targets: 8

2026-06-22

Number of reports: 14

Distinct targets: 5

2026-06-23

Number of reports: 54

Distinct targets: 19

2026-06-24

Number of reports: 18

Distinct targets: 5

2026-06-25

Number of reports: 18

Distinct targets: 5

2026-06-26

Number of reports: 10

Distinct targets: 3

2026-07-01

Number of reports: 30

Distinct targets: 7

2026-07-02

Number of reports: 35

Distinct targets: 12

2026-07-03

Number of reports: 63

Distinct targets: 23

2026-07-04

Number of reports: 105

Distinct targets: 32

2026-07-05

Number of reports: 105

Distinct targets: 32

2026-07-06

Number of reports: 35

Distinct targets: 13

2026-07-07

Number of reports: 35

Distinct targets: 13

2026-07-08

Number of reports: 87

Distinct targets: 28

2026-07-09

Number of reports: 33

Distinct targets: 14

2026-07-10

Number of reports: 33

Distinct targets: 14

2026-07-11

Number of reports: 12

Distinct targets: 3

2026-07-12

Number of reports: 12

Distinct targets: 3

2026-07-13

Number of reports: 82

Distinct targets: 22

2026-07-14

Number of reports: 60

Distinct targets: 18

2026-07-15

Number of reports: 60

Distinct targets: 18

2026-07-19

Number of reports: 32

Distinct targets: 10

2026-07-21

Number of reports: 20

Distinct targets: 7

2026-07-22

Number of reports: 20

Distinct targets: 7

2026-07-28

Number of reports: 139

Distinct targets: 66

2026-07-29

Number of reports: 139

Distinct targets: 66

2026-08-02

Number of reports: 38

Distinct targets: 16

2026-08-03

Number of reports: 55

Distinct targets: 24

2026-08-04

Number of reports: 36

Distinct targets: 10

Origin AS

AS16276 - OVH

BGP Prefix

103.244.227.0/24

geo

Germany, Frankfurt am Main

🕑 Europe/Berlin

hostname

undefined.hostname.localhost

Address block ('inetnum' or 'NetRange' in whois database)

103.244.226.0 - 103.244.227.255

last_activity

2026-07-28 05:26:00

last_warden_event

2026-07-28 05:26:00

rep

0.17206215864209973

reserved_range

0

ts_added

2026-06-07 05:01:59.341000

ts_last_update

2026-08-07 09:50:42.149000

Warden event timeline

DShield event timeline

Presence on blacklists