IP address

Shodan(more info)

Passive DNS

Tags:

IP blacklists: blocklist.de SSH
159.223.12.190 is listed on the blocklist.de SSH blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs performing SSH attacks.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-14 17:05:05.184000
Was present on blacklist at: 2025-12-14 17:05
Spamhaus SBL CSS
159.223.12.190 is listed on the Spamhaus SBL CSS blacklist.

Description: The Spamhaus CSS is part of the SBL. CSS listings will have return code 127.0.0.3 to differentiate from regular SBL listings, which have return code 127.0.0.2.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-12-14 17:07:02.241000
Was present on blacklist at: 2025-12-14 17:07
DataPlane SSH login
159.223.12.190 is listed on the DataPlane SSH login blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. IPs trying an unsolicited login to a host using SSH password authentication.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-16 03:10:01.862000
Was present on blacklist at: 2025-12-14 19:10, 2025-12-15 03:10, 2025-12-15 07:10, 2025-12-15 15:10, 2025-12-15 19:10, 2025-12-16 03:10
blocklist.de web-login
159.223.12.190 is listed on the blocklist.de web-login blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs that attacks Joomla, Wordpress and other Web-Logins with Brute-Force Logins.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-16 05:05:00.474000
Was present on blacklist at: 2025-12-14 23:05, 2025-12-15 05:05, 2025-12-15 11:05, 2025-12-15 17:05, 2025-12-15 23:05, 2025-12-16 05:05
blocklist.de Apache
159.223.12.190 is listed on the blocklist.de Apache blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs performing attacks on the service Apache, Apache-DDOS, RFI-Attacks.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-16 05:05:00.589000
Was present on blacklist at: 2025-12-14 23:05, 2025-12-15 05:05, 2025-12-15 11:05, 2025-12-15 17:05, 2025-12-15 23:05, 2025-12-16 05:05

Origin AS: AS14061 - DIGITALOCEAN-ASN
BGP Prefix: 159.223.0.0/20
geo: Netherlands, Amsterdam; 🕑 Europe/Amsterdam
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 159.223.0.0 - 159.223.255.255
reserved_range: 0
Shodan's InternetDB: Open ports: 21, 23, 80, 88, 101, 110, 122, 139, 143, 234, 311, 343, 442, 444, 445, 541, 636, 811, 830, 902, 1024, 1311, 1337, 1400, 1414, 1433, 1443, 1515, 1935, 2008, 2109, 2210, 2222, 2332, 2404, 2628, 3001, 3101, 3103, 3115, 3128, 3132, 3134, 3140, 3143, 3301, 3311, 3401, 3521, 3541, 4022, 4023, 4103, 4433, 4510, 4821, 4911, 5001, 5007, 5009, 5010, 5140, 5222, 5225, 5244, 5500, 5523, 5620, 5801, 5901, 5912, 5917, 6000, 6002, 6100, 6134, 6511, 6601, 6603, 7001, 7016, 7302, 7434, 7441, 7634, 7700, 8001, 8009, 8010, 8029, 8032, 8035, 8043, 8100, 8124, 8126, 8134, 8139, 8140, 8200, 8333, 8401, 8420, 8442, 8503, 8600, 8622, 8707, 8745, 8813, 8834, 8837, 8901, 8905, 8913, 8916, 9014, 9033, 9034, 9100, 9105, 9111, 9128, 9130, 9132, 9134, 9139, 9204, 9222, 9306, 9333, 9433, 9443, 9530, 9633, 9734, 9800, 9900, 9909, 9944, 10001, 10006, 10009, 10017, 10023, 10036, 10043, 10134, 10200, 10302, 10443, 10909, 10911, 11000, 11007, 11211, 11300; Tags: cloud; CPEs: –
ts_added: 2025-12-14 17:07:02.072000
ts_last_update: 2025-12-16 05:10:44.284000

Warden event timeline

DShield event timeline

Presence on blacklists