IP address

Search at other sites:

.004104.105.81.199

Shodan(more info)

Passive DNS

IP blacklists

blocklist.de SSH

104.105.81.199 is listed on the blocklist.de SSH blacklist.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing SSH attacks.
Type of feed: primary (feed detail page)

Last checked at: 2026-06-10 10:05:00.348000
Was present on blacklist at: 2026-05-24 04:05, 2026-05-24 10:05, 2026-05-24 16:05, 2026-05-24 22:05, 2026-05-25 04:05, 2026-05-25 10:05, 2026-05-25 16:05, 2026-05-25 22:05, 2026-05-26 04:05, 2026-05-26 10:05, 2026-06-07 10:05, 2026-06-07 16:05, 2026-06-07 22:05, 2026-06-08 04:05, 2026-06-08 10:05, 2026-06-08 16:05, 2026-06-08 22:05, 2026-06-09 04:05, 2026-06-09 10:05, 2026-06-09 16:05, 2026-06-09 22:05, 2026-06-10 04:05, 2026-06-10 10:05

AbuseIPDB

104.105.81.199 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-06-04 04:00:00.636000
Was present on blacklist at: 2026-05-27 04:00, 2026-06-04 04:00

blocklist.de FTP

104.105.81.199 is listed on the blocklist.de FTP blacklist.

Description: Blocklist.de feed is a free and voluntary service<br>provided by a Fraud/Abuse-specialist. IPs performing attacks<br>on the Service FTP.
Type of feed: primary (feed detail page)

Last checked at: 2026-06-06 04:05:00.142000
Was present on blacklist at: 2026-06-04 04:05, 2026-06-04 10:05, 2026-06-04 16:05, 2026-06-04 22:05, 2026-06-05 04:05, 2026-06-05 10:05, 2026-06-05 16:05, 2026-06-05 22:05, 2026-06-06 04:05

Threat categories

TL	Role	Category	Details
No threat category tags assigned

---

Warden events (28)

2026-06-07

IntrusionUserCompromise (node.40929a): 1

2026-06-04

IntrusionUserCompromise (node.cfb4f7): 6

2026-05-31

IntrusionUserCompromise (node.cfb4f7): 15

2026-05-28

IntrusionUserCompromise (node.cfb4f7): 4

2026-05-24

AttemptLogin (node.40929a): 1

IntrusionUserCompromise (node.40929a): 1

DShield reports (IP summary, reports)

2026-06-04

Number of reports: 10

Distinct targets: 3

2026-06-08

Number of reports: 37

Distinct targets: 3

OTX pulses

[6a1ad7aca8cb1de94f191e1d] 2026-05-30 12:27:24.857000 | VNC honeypot logs for 2026/05/30

Author name:	jnazario
Pulse modified:	2026-05-30 12:27:24.857000
Indicator created:	2026-05-30 12:27:25
Indicator role:	None
Indicator title:
Indicator expiration:	2026-06-29 12:00:00

[6a201d91a1b752b4bb136915] 2026-06-03 12:26:57.945000 | VNC honeypot logs for 2026/06/03

Author name:	jnazario
Pulse modified:	2026-06-03 12:26:57.945000
Indicator created:	2026-06-03 12:26:58
Indicator role:	None
Indicator title:
Indicator expiration:	2026-07-03 12:00:00

Origin AS

AS63949 - LINODE-AP

BGP Prefix

104.105.64.0/19

geo

Italy, Milan

🕑 Europe/Rome

hostname

(null)

hostname_class

['ip_in_hostname']

Address block ('inetnum' or 'NetRange' in whois database)

104.64.0.0 - 104.127.255.255

last_activity

2026-06-07 09:23:39.197000

last_warden_event

2026-06-07 09:14:54.406000

rep

0.004301075268817178

reserved_range

0

ts_added

2026-05-24 04:05:45.303000

ts_last_update

2026-06-30 04:05:53.505000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses