IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

192.109.200.24 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-02-06 17:57:50.235000
Was present on blacklist at: 2026-01-30 17:57, 2026-02-06 17:57

Spamhaus DROP

192.109.200.24 is listed on the Spamhaus DROP blacklist.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-02-06 17:57:50.235000
Was present on blacklist at: 2026-01-30 17:57, 2026-02-06 17:57

DataPlane SSH login

192.109.200.24 is listed on the DataPlane SSH login blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. IPs trying an unsolicited login to a host using SSH password authentication.
Type of feed: primary (feed detail page)

Last checked at: 2026-02-06 15:10:25.690000
Was present on blacklist at: 2026-01-31 03:10, 2026-01-31 07:10, 2026-01-31 15:10, 2026-01-31 19:10, 2026-02-01 03:10, 2026-02-01 07:10, 2026-02-01 15:10, 2026-02-01 19:10, 2026-02-02 03:10, 2026-02-02 07:10, 2026-02-02 15:10, 2026-02-02 19:10, 2026-02-03 03:10, 2026-02-03 07:10, 2026-02-03 15:10, 2026-02-03 19:10, 2026-02-04 03:10, 2026-02-04 07:10, 2026-02-04 15:10, 2026-02-05 03:10, 2026-02-05 15:10, 2026-02-05 19:10, 2026-02-06 03:10, 2026-02-06 07:10, 2026-02-06 15:10

DataPlane SSH conn

192.109.200.24 is listed on the DataPlane SSH conn blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. IP addresses that has been seen initiating an unsolicited SSH connection to a remote host.
Type of feed: primary (feed detail page)

Last checked at: 2026-02-06 19:10:03.869000
Was present on blacklist at: 2026-01-31 03:10, 2026-01-31 07:10, 2026-01-31 15:10, 2026-01-31 19:10, 2026-02-01 03:10, 2026-02-01 07:10, 2026-02-01 15:10, 2026-02-01 19:10, 2026-02-02 03:10, 2026-02-02 07:10, 2026-02-02 15:10, 2026-02-02 19:10, 2026-02-03 03:10, 2026-02-03 07:10, 2026-02-03 15:10, 2026-02-03 19:10, 2026-02-04 03:10, 2026-02-04 07:10, 2026-02-04 15:10, 2026-02-04 19:10, 2026-02-05 03:10, 2026-02-05 07:10, 2026-02-05 11:10, 2026-02-05 15:10, 2026-02-05 19:10, 2026-02-05 23:10, 2026-02-06 03:10, 2026-02-06 07:10, 2026-02-06 11:10, 2026-02-06 15:10, 2026-02-06 19:10

CI Army

192.109.200.24 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence database that provides scores for IPs. Source of unspecified malicious attacks most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2026-02-04 03:50:01.042000
Was present on blacklist at: 2026-01-31 03:50, 2026-02-01 03:50, 2026-02-02 03:50, 2026-02-03 03:50, 2026-02-04 03:50

AbuseIPDB

192.109.200.24 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc. Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-02-10 05:00:00.598000
Was present on blacklist at: 2026-01-31 05:00, 2026-02-01 05:00, 2026-02-02 05:00, 2026-02-03 05:00, 2026-02-04 05:00, 2026-02-05 05:00, 2026-02-06 05:00, 2026-02-07 05:00, 2026-02-08 05:00, 2026-02-09 05:00, 2026-02-10 05:00

Spamhaus XBL CBL

192.109.200.24 is listed on the Spamhaus XBL CBL blacklist.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-02-06 17:57:50.235000
Was present on blacklist at: 2026-02-06 17:57

Threat categories

TL	Role	Category	Details
50	src	scan	port: 5555

Warden events (2831)

2026-02-11: ReconScanning (node.4dc198): 21; ReconScanning (node.368407): 20; ReconScanning (node.9c1411): 5
2026-02-10: ReconScanning (node.368407): 107; ReconScanning (node.4dc198): 107; ReconScanning (node.9c1411): 31
2026-02-09: ReconScanning (node.9c1411): 17; ReconScanning (node.368407): 56; ReconScanning (node.4dc198): 55
2026-02-08: ReconScanning (node.4dc198): 189; ReconScanning (node.368407): 188; ReconScanning (node.9c1411): 50
2026-02-07: ReconScanning (node.4dc198): 138; ReconScanning (node.368407): 139; ReconScanning (node.9c1411): 37
2026-02-06: ReconScanning (node.368407): 123; ReconScanning (node.4dc198): 125; ReconScanning (node.9c1411): 32
2026-02-05: ReconScanning (node.4dc198): 81; ReconScanning (node.368407): 78; ReconScanning (node.9c1411): 24
2026-02-04: ReconScanning (node.368407): 34; ReconScanning (node.4dc198): 34; ReconScanning (node.9c1411): 9
2026-02-03: ReconScanning (node.4dc198): 141; ReconScanning (node.368407): 135; ReconScanning (node.9c1411): 37; AnomalyTraffic (node.ffe95c): 1
2026-02-02: ReconScanning (node.368407): 170; ReconScanning (node.4dc198): 171; ReconScanning (node.9c1411): 33
2026-02-01: ReconScanning (node.4dc198): 41; ReconScanning (node.368407): 39; AnomalyTraffic (node.ffe95c): 2
2026-01-31: ReconScanning (node.4dc198): 125; ReconScanning (node.368407): 125
2026-01-30: ReconScanning (node.368407): 52; ReconScanning (node.4dc198): 55; AnomalyTraffic (node.ffe95c): 2; IntrusionUserCompromise (node.40929a): 2

Origin AS: AS51396 - PFCLOUD
BGP Prefix: 192.109.200.0/24
geo: Sweden, Stockholm; 🕑 Europe/Stockholm
hostname: somberpoison.ptr.network
Address block ('inetnum' or 'NetRange' in whois database): 192.109.200.0 - 192.109.201.255
last_activity: 2026-02-11 01:42:15
last_warden_event: 2026-02-11 01:42:15
rep: 0.8678571428571428
reserved_range: 0
ts_added: 2026-01-30 17:57:41.099000
ts_last_update: 2026-02-11 01:43:55.977000

Warden event timeline

DShield event timeline

Presence on blacklists