IP address
Tags:
Scanner
Login attempts
- IP blacklists
UCEPROTECT L1
194.180.48.122 is listed on the UCEPROTECT L1 blacklist.
Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed:
primary (
feed detail page)
Last checked at:
2025-10-20 07:45:00.645000
Was present on blacklist at:
2025-10-13 15:45,
2025-10-13 23:45,
2025-10-14 07:45,
2025-10-14 15:45,
2025-10-14 23:45,
2025-10-15 07:45,
2025-10-15 15:45,
2025-10-15 23:45,
2025-10-16 07:45,
2025-10-16 15:45,
2025-10-16 23:45,
2025-10-17 07:45,
2025-10-17 15:45,
2025-10-17 23:45,
2025-10-18 07:45,
2025-10-18 15:45,
2025-10-18 23:45,
2025-10-19 07:45,
2025-10-19 15:45,
2025-10-19 23:45,
2025-10-20 07:45
Spamhaus XBL CBL
194.180.48.122 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.
Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed:
secondary (DNSBL) (
feed detail page)
Last checked at:
2025-12-15 17:45:20.192000
Was present on blacklist at:
2025-10-13 17:45
DShield Block
194.180.48.122 was recently listed on the DShield Block blacklist, but currently it is not.
Description: Recommended Block List by DShield.org. It summarizes the top 20 attacking<br>class C (/24) subnets over the last three days.
Type of feed:
secondary (
feed detail page)
Last checked at:
2025-12-18 04:50:00
Was present on blacklist at:
2025-10-13 04:50,
2025-10-16 04:50,
2025-10-18 04:50,
2025-10-20 04:50,
2025-10-22 04:50,
2025-10-26 04:50,
2025-10-28 04:50,
2025-11-03 04:50,
2025-11-05 04:50,
2025-11-06 04:50,
2025-11-13 04:50,
2025-11-15 04:50,
2025-11-16 04:50,
2025-11-25 04:50,
2025-11-27 04:50,
2025-11-29 04:50,
2025-12-01 04:50,
2025-12-02 04:50,
2025-12-04 04:50,
2025-12-05 04:50,
2025-12-06 04:50,
2025-12-13 04:50,
2025-12-15 04:50,
2025-12-16 04:50,
2025-12-17 04:50
blocklist.de IMAP
194.180.48.122 is listed on the blocklist.de IMAP blacklist.
Description: Blocklist.de feed is a free and voluntary service<br>provided by a Fraud/Abuse-specialist. IPs performing attacks<br>on the Service imap, sasl, pop3.
Type of feed:
primary (
feed detail page)
Last checked at:
2025-11-06 17:05:00.343000
Was present on blacklist at:
2025-11-04 23:05,
2025-11-05 05:05,
2025-11-05 11:05,
2025-11-05 17:05,
2025-11-05 23:05,
2025-11-06 05:05,
2025-11-06 11:05,
2025-11-06 17:05
blocklist.de mail
194.180.48.122 is listed on the blocklist.de mail blacklist.
Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing Mail attacks.
Type of feed:
primary (
feed detail page)
Last checked at:
2025-11-06 17:05:00.591000
Was present on blacklist at:
2025-11-04 23:05,
2025-11-05 05:05,
2025-11-05 11:05,
2025-11-05 17:05,
2025-11-05 23:05,
2025-11-06 05:05,
2025-11-06 11:05,
2025-11-06 17:05
AbuseIPDB
194.180.48.122 is listed on the AbuseIPDB blacklist.
Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed:
primary (
feed detail page)
Last checked at:
2025-11-21 05:00:00.674000
Was present on blacklist at:
2025-11-21 05:00
Turris greylist
194.180.48.122 is listed on the Turris greylist blacklist.
Description: Greylist is the output of the Turris research project by CZ.NIC,<br>which collects data of malicious IPs.
Type of feed:
primary (
feed detail page)
Last checked at:
2025-11-21 22:15:00.172000
Was present on blacklist at:
2025-11-21 22:15
- Warden events (23)
- 2025-11-23
-
-
ReconScanning (node.9c1411): 5
- 2025-11-22
-
-
ReconScanning (node.9c1411): 8
- 2025-11-21
-
-
ReconScanning (node.9c1411): 3
- 2025-11-20
-
-
AttemptLogin (node.03e7a9): 5
-
AttemptLogin (node.985fb4): 1
-
ReconScanning (node.5bdc26): 1
- DShield reports (IP summary, reports)
- 2025-11-17
- Number of reports: 18
- Distinct targets: 9
- 2025-11-18
- Number of reports: 18
- Distinct targets: 9
- OTX pulses
-
[68ecf0909efbaf4f4e840c6f] 2025-10-13 12:29:04.139000 | RDP honeypot logs for 2025/10/13
| Author name: | jnazario |
| Pulse modified: | 2025-10-13 12:29:04.139000 |
| Indicator created: | 2025-10-13 12:29:05 |
| Indicator role: | None |
| Indicator title: | |
| Indicator expiration: | 2025-11-12 12:00:00 |
- Origin AS
- AS201814 - PL-SKYTECH-AS
- AS15440 - Baltneta
- BGP Prefix
- 194.180.48.0/24
- geo
-
Germany, Berngau
- 🕑 Europe/Berlin
- hostname
- (null)
- Address block ('inetnum' or 'NetRange' in whois database)
- 194.180.48.0 - 194.180.49.255
- last_activity
- 2025-11-23 07:27:52
- last_warden_event
- 2025-11-23 07:27:52
- rep
- 0.0
- reserved_range
- 0
- Shodan's InternetDB
- Open ports: 135, 139, 445, 3389, 5985, 47001
- Tags: self-signed
- CPEs: –
- ts_added
- 2025-10-13 17:45:11.806000
- ts_last_update
- 2025-12-18 17:45:20.054000
Warden event timeline
DShield event timeline
Presence on blacklists
OTX pulses
