IP address

Search at other sites:
.000159.89.104.241
Shodan(more info)
Passive DNS
Tags:
IP blacklists
DataPlane SMTP greeting
159.89.104.241 is listed on the DataPlane SMTP greeting blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds,<br>and measurement resource for operators, by operators. IPs that are<br>identified as SMTP clients issuing unsolicited HELO or EHLO commands.
Type of feed: primary (feed detail page)

Last checked at: 2025-03-21 07:10:01.117000
Was present on blacklist at: 2025-03-09 11:10, 2025-03-09 15:10, 2025-03-09 19:10, 2025-03-09 23:10, 2025-03-10 03:10, 2025-03-10 07:10, 2025-03-10 11:10, 2025-03-10 15:10, 2025-03-10 19:10, 2025-03-10 23:10, 2025-03-11 03:10, 2025-03-11 07:10, 2025-03-11 11:10, 2025-03-11 15:10, 2025-03-11 19:10, 2025-03-11 23:10, 2025-03-12 03:10, 2025-03-12 07:10, 2025-03-12 11:10, 2025-03-12 15:10, 2025-03-12 19:10, 2025-03-12 23:10, 2025-03-13 03:10, 2025-03-13 07:10, 2025-03-13 11:10, 2025-03-13 15:10, 2025-03-13 19:10, 2025-03-13 23:10, 2025-03-14 03:10, 2025-03-14 07:10, 2025-03-14 11:10, 2025-03-14 15:10, 2025-03-14 19:10, 2025-03-14 23:10, 2025-03-15 03:10, 2025-03-15 07:10, 2025-03-15 11:10, 2025-03-15 15:10, 2025-03-15 19:10, 2025-03-15 23:10, 2025-03-16 03:10, 2025-03-16 07:10, 2025-03-16 11:10, 2025-03-16 15:10, 2025-03-16 19:10, 2025-03-16 23:10, 2025-03-17 03:10, 2025-03-17 07:10, 2025-03-17 11:10, 2025-03-17 15:10, 2025-03-17 19:10, 2025-03-17 23:10, 2025-03-18 03:10, 2025-03-18 07:10, 2025-03-18 11:10, 2025-03-18 15:10, 2025-03-18 19:10, 2025-03-18 23:10, 2025-03-19 03:10, 2025-03-19 07:10, 2025-03-19 11:10, 2025-03-19 15:10, 2025-03-19 19:10, 2025-03-19 23:10, 2025-03-20 03:10, 2025-03-20 07:10, 2025-03-20 11:10, 2025-03-20 15:10, 2025-03-20 19:10, 2025-03-20 23:10, 2025-03-21 03:10, 2025-03-21 07:10
UCEPROTECT L1
159.89.104.241 is listed on the UCEPROTECT L1 blacklist.

Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed: primary (feed detail page)

Last checked at: 2025-03-19 16:45:00.755000
Was present on blacklist at: 2025-03-10 00:45, 2025-03-10 08:45, 2025-03-10 16:45, 2025-03-11 00:45, 2025-03-11 08:45, 2025-03-11 16:45, 2025-03-12 00:45, 2025-03-12 08:45, 2025-03-12 16:45, 2025-03-13 00:45, 2025-03-13 08:45, 2025-03-13 16:45, 2025-03-14 00:45, 2025-03-14 08:45, 2025-03-14 16:45, 2025-03-15 00:45, 2025-03-15 08:45, 2025-03-15 16:45, 2025-03-16 00:45, 2025-03-16 08:45, 2025-03-16 16:45, 2025-03-17 00:45, 2025-03-17 08:45, 2025-03-17 16:45, 2025-03-18 00:45, 2025-03-18 08:45, 2025-03-18 16:45, 2025-03-19 00:45, 2025-03-19 08:45, 2025-03-19 16:45
AbuseIPDB
159.89.104.241 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2025-04-22 04:00:00.601000
Was present on blacklist at: 2025-03-10 05:00, 2025-03-11 05:00, 2025-03-13 05:00, 2025-03-14 05:00, 2025-03-15 05:00, 2025-04-20 04:00, 2025-04-22 04:00
Turris greylist
159.89.104.241 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC,<br>which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2025-03-14 22:15:00.181000
Was present on blacklist at: 2025-03-10 22:15, 2025-03-11 22:15, 2025-03-12 22:15, 2025-03-13 22:15, 2025-03-14 22:15
Spamhaus SBL CSS
159.89.104.241 was recently listed on the Spamhaus SBL CSS blacklist, but currently it is not.

Description: The Spamhaus CSS is part of the SBL. CSS listings will have return code 127.0.0.3 to differentiate from regular SBL listings, which have return code 127.0.0.2.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-05-04 04:34:00.182000
Was present on blacklist at: 2025-03-16 04:34
Spamhaus XBL CBL
159.89.104.241 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-05-04 04:34:00.182000
Was present on blacklist at: 2025-03-16 04:34
CI Army
159.89.104.241 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence<br>database that provides scores for IPs. Source of unspecified malicious attacks<br>most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2025-04-28 02:50:01.132000
Was present on blacklist at: 2025-04-23 02:50, 2025-04-28 02:50
Warden events (1440)
2025-04-19
ReconScanning (node.9c1411): 4
2025-04-17
ReconScanning (node.9c1411): 2
2025-03-14
ReconScanning (node.9c1411): 9
2025-03-13
ReconScanning (node.9c1411): 37
IntrusionUserCompromise (node.cfb4f7): 288
2025-03-12
ReconScanning (node.9c1411): 39
IntrusionUserCompromise (node.cfb4f7): 225
2025-03-11
IntrusionUserCompromise (node.cfb4f7): 336
ReconScanning (node.9c1411): 39
2025-03-10
IntrusionUserCompromise (node.cfb4f7): 246
ReconScanning (node.9c1411): 15
2025-03-09
IntrusionUserCompromise (node.cfb4f7): 200
DShield reports (IP summary, reports)
2025-03-09
Number of reports: 95
Distinct targets: 26
2025-03-10
Number of reports: 208
Distinct targets: 41
2025-03-11
Number of reports: 161
Distinct targets: 38
2025-03-12
Number of reports: 277
Distinct targets: 55
2025-03-13
Number of reports: 88
Distinct targets: 29
OTX pulses
[5a7e3e70c44e7b48947593a7] 2018-02-10 00:36:00.396000 | Webscanners 2018-02-09 thru current day
Author name:david3
Pulse modified:2025-04-12 03:55:24.123000
Indicator created:2025-03-13 07:15:22
Indicator role:scanning_host
Indicator title:404 NOT FOUND
Indicator expiration:2025-06-11 00:00:00
Origin AS
AS14061 - DIGITALOCEAN-ASN
BGP Prefix
159.89.96.0/20
geo
Germany, Frankfurt am Main
🕑 Europe/Berlin
hostname
(null)
Address block ('inetnum' or 'NetRange' in whois database)
159.89.0.0 - 159.89.255.255
last_activity
2025-04-19 06:05:27
last_warden_event
2025-04-19 06:05:27
rep
0.0
reserved_range
0
Shodan's InternetDB
Open ports: 104, 111, 122, 211, 513, 515, 1111, 1234, 1400, 1414, 1500, 1515, 1521, 1925, 2002, 2008, 2021, 2130, 2210, 2222, 2232, 2320, 2344, 2444, 2626, 3022, 3103, 3114, 3128, 3404, 3500, 3541, 4000, 4040, 4343, 4734, 4911, 5000, 5001, 5005, 5006, 5007, 5009, 5025, 5119, 5201, 5209, 5222, 5400, 5431, 5432, 5446, 5640, 5900, 5901, 6000, 6543, 7001, 7010, 7012, 7218, 7415, 7445, 8000, 8001, 8008, 8115, 8117, 8123, 8127, 8139, 8333, 8425, 8540, 8602, 8606, 8641, 8705, 8706, 8724, 8822, 8834, 8846, 8912, 9002, 9017, 9032, 9039, 9045, 9200, 9204, 9306, 9633, 9734, 9930, 10000, 10001, 10023, 10035, 10046, 10047, 10134, 10209, 10443, 10444, 10445, 10934, 11000, 11211, 11434
Tags: cloud
CPEs: –
ts_added
2025-03-09 04:33:54.370000
ts_last_update
2025-05-06 04:34:00.332000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses