IP address

Warden events (3)

2025-12-07

ReconScanning (node.9c1411): 1

2025-12-06

ReconScanning (node.9c1411): 2

Origin AS

AS14061 - DIGITALOCEAN-ASN

BGP Prefix

178.128.160.0/20

geo

United Kingdom, Slough

🕑 Europe/London

hostname

(null)

Address block ('inetnum' or 'NetRange' in whois database)

178.128.128.0 - 178.128.255.255

last_activity

2025-12-07 20:13:33

last_warden_event

2025-12-07 20:13:33

rep

0.0

reserved_range

0

Shodan's InternetDB

Open ports: 22, 23, 104, 135, 161, 465, 587, 1063, 1119, 1153, 1193, 1200, 1234, 1290, 1311, 1400, 1414, 1433, 1443, 1458, 1471, 1515, 1521, 1554, 1604, 1723, 1800, 1801, 1883, 1926, 1935, 1953, 1960, 1962, 1965, 1967, 1972, 1977, 1980, 2000, 2003, 2008, 2062, 2068, 2078, 2081, 2083, 2103, 2181, 2200, 2222, 2323, 2345, 2375, 2376, 2404, 2506, 2553, 2558, 2559, 2567, 2601, 2628, 2761, 2762, 3001, 3012, 3015, 3016, 3030, 3050, 3069, 3080, 3101, 3104, 3106, 3107, 3119, 3121, 3122, 3123, 3124, 3128, 3137, 3144, 3152, 3186, 3189, 3268, 3269, 3299, 3306, 3333, 3410, 3412, 3460, 3541, 3542, 3548, 3550, 3551, 3553, 3559, 3569, 3590, 3622, 3689, 4000, 4022, 4023, 4063, 4064, 4085, 4095, 4120, 4157, 4165, 4282, 4433, 4440, 4444, 4500, 4506, 4664, 4786, 4840, 4899, 4911, 4949, 5006, 5009, 5010, 5090, 5135, 5224, 5251, 5254, 5269, 5400, 5431, 5432, 5454, 5556, 5600, 5672, 5800, 5801, 5900, 5901, 5938, 5984, 5991, 5994, 6005, 6134, 6308, 6379, 6432, 6443, 6500, 6653, 6667, 6697, 6699, 6789, 7001, 7004, 7071, 7171, 7218, 7325, 7415, 7443, 7474, 7480, 7535, 7547, 7548, 7601, 7654, 7777, 7779, 7799, 8000, 8002, 8004, 8008, 8009, 8010, 8011, 8014, 8015, 8016, 8041, 8047, 8058, 8060, 8062, 8065, 8069, 8074, 8080, 8081, 8083, 8085, 8087, 8089, 8093, 8098, 8103, 8105, 8129, 8130, 8131, 8135, 8139, 8140, 8152, 8155, 8157, 8161, 8162, 8163, 8165, 8166, 8167, 8179, 8181, 8185, 8191, 8195, 8200, 8230, 8241, 8316, 8319, 8333, 8334, 8412, 8416, 8424, 8460, 8532, 8545, 8606, 8643, 8724, 8800, 8820, 8831, 8837, 8839, 8840, 8841, 8851, 8874, 8879, 8883, 8889, 8890, 8913, 8935, 8980, 9001, 9002, 9009, 9015, 9022, 9042, 9068, 9077, 9080, 9085, 9089, 9093, 9095, 9117, 9132, 9139, 9147, 9151, 9160, 9187, 9189, 9192, 9203, 9207, 9214, 9218, 9230, 9244, 9292, 9295, 9306, 9418, 9443, 9550, 9600, 9633, 9761, 9869, 9944, 9991, 9993, 9998, 10000, 10001, 10012, 10014, 10027, 10040, 10071, 10083, 10134, 10250, 10251, 10443, 10554, 10810, 10909, 10911, 11000, 11065, 11112, 11210, 11211, 11300, 11401, 11601, 11602, 12088, 12107, 12129, 12157, 12191, 12199, 12210, 12211, 12222, 12224, 12226, 12228, 12233, 12258, 12294, 12301, 12329, 12368, 12399, 12454, 12467, 12472, 12476, 12488, 12490, 12497, 12529, 12538, 12540, 12547, 12549, 13082, 13228, 13443, 14147, 14265, 14880, 14903, 15151, 16004, 16013, 16041, 16052, 16059, 16075, 16088, 16400, 16800, 16992, 17102, 18010, 18016, 18019, 18029, 18033, 18036, 18064, 18066, 18102, 18181, 18239, 18765, 19071, 19222, 20000, 20090, 20121, 20182, 20600, 20880, 21001, 21025, 21241, 21242, 21254, 21256, 21257, 21265, 21272, 21296, 21379, 22082, 23023, 23424, 24808, 25007, 25009, 27015, 28017, 30002, 30009, 30010, 30021, 30050, 30110, 32764, 35000, 35101, 40000, 41800, 44100, 44303, 44399, 44818, 45555, 45888, 47080, 47534, 47990, 49152, 49153, 49443, 49690, 50000, 50004, 50006, 50042, 50070, 50107, 50160, 50999, 51002, 51007, 51106, 51235, 51434, 52311, 52869, 52931, 55000, 55388, 55442, 55481, 55553, 55554, 57786, 60001, 61613, 61616, 62078, 63210, 63256, 63260, 64295, 65432

Tags: honeypot, database, self-signed, vpn, cloud

CPEs: cpe:/a:apache:http_server:2.2.22, cpe:/o:canonical:ubuntu_linux, cpe:/a:php:php, cpe:/a:redislabs:redis, cpe:/a:apache:tomcat, cpe:/a:microsoft:sql_server:8.0.528.0, cpe:/a:exim:exim:4.97, cpe:/o:microsoft:windows, cpe:/a:famatech:radmin, cpe:/a:wordpress:wordpress:2.8, cpe:/a:openbsd:openssh:8.9p1, cpe:/a:mysql:mysql

ts_added

2025-12-06 07:56:47.938000

ts_last_update

2025-12-21 07:56:51.650000

Warden event timeline

DShield event timeline