IP address

Search at other sites:
.043196.251.121.142
Shodan(more info)
Passive DNS
Tags:
IP blacklists
Spamhaus SBL
196.251.121.142 was recently listed on the Spamhaus SBL blacklist, but currently it is not.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-10-30 07:16:01.229000
Was present on blacklist at: 2026-08-28 07:15, 2026-09-04 07:16, 2026-09-11 07:16, 2026-09-18 07:16, 2026-09-25 07:16, 2026-10-02 07:16, 2026-10-09 07:16, 2026-10-16 07:16, 2026-10-23 07:16, 2026-10-30 07:16
Spamhaus DROP
196.251.121.142 was recently listed on the Spamhaus DROP blacklist, but currently it is not.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-10-30 07:16:01.229000
Was present on blacklist at: 2026-08-28 07:15, 2026-09-04 07:16, 2026-09-11 07:16, 2026-09-18 07:16, 2026-09-25 07:16, 2026-10-02 07:16, 2026-10-09 07:16, 2026-10-16 07:16, 2026-10-23 07:16, 2026-10-30 07:16
AbuseIPDB
196.251.121.142 was recently listed on the AbuseIPDB blacklist, but currently it is not.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-09-20 04:00:00.576000
Was present on blacklist at: 2026-09-10 04:00, 2026-09-20 04:00

Threat categories

TLRoleCategoryDetails
50 src scan port: 22, 23, 80, 2222, 2323, 5555, 8080, 8111, 8443
25 src login protocol: ssh
port: 80
25 dst malware_distribution
25 src —
Warden events (9)
2026-11-03
ReconScanning (node.4dc198): 2
ReconScanning (node.ce2b59): 3
ReconScanning (node.9c1411): 2
AnomalyTraffic (node.6a1878): 1
2026-09-29
AnomalyTraffic (node.6a1878): 1
MISP events
[4] 2026-06-04 00:00:00 | Malicious URLs from SSH honeypots (GEANT T-Pot)
Reporting org.:CESNET_1152
TLP:clear
Tags: coa:discover=honeypotrsit:malicious-code="malware-distribution"CESNET:malware-urlsCESNET:source='GEANT T-Pot'
Sightings:positive: 0 | false positive: 0 | expired attribute: 0
Last change:2026-09-05 16:01:48
Threat level:Low
Role of this IP:dst
[7] 2026-06-04 00:00:00 | Malicious URLs from SSH honeypots (HoneyNet.Asia)
Reporting org.:CESNET_1152
TLP:clear
Tags: coa:discover=honeypotrsit:malicious-code="malware-distribution"CESNET:malware-urlsCESNET:source='HoneyNet.Asia'
Sightings:positive: 0 | false positive: 0 | expired attribute: 0
Last change:2026-09-05 16:01:45
Threat level:Low
Role of this IP:dst
[8] 2025-11-14 00:00:00 | Malicious URLs from SSH honeypots
Reporting org.:CESNET_1152
TLP:clear
Tags: coa:discover=honeypotrsit:malicious-code="malware-distribution"CESNET:malware-urlsCESNET:source='all'
Sightings:positive: 0 | false positive: 0 | expired attribute: 0
Last change:2026-10-29 16:01:04
Threat level:Low
Role of this IP:dst
OTX pulses
[6a7b13845462f65e0c12c01f] 2026-08-11 12:20:20.616000 | Apache honeypot logs for 11/Aug/2026
Author name:jnazario
Pulse modified:2026-08-11 12:20:20.616000
Indicator created:2026-08-11 12:20:21
Indicator role:None
Indicator title:
Indicator expiration:2026-09-10 12:00:00
[6a6f363cbb1aa508ceaf2aed] 2026-08-02 12:21:16.743000 | Apache honeypot logs for 02/Aug/2026
Author name:jnazario
Pulse modified:2026-08-02 12:21:16.743000
Indicator created:2026-08-02 12:21:18
Indicator role:None
Indicator title:
Indicator expiration:2026-09-01 12:00:00
Origin AS
AS205759 - GHOSTYNETWORKS
AS403005 -
BGP Prefix
196.251.121.0/24
geo
Seychelles
🕑 Indian/Mahe
hostname
(null)
Address block ('inetnum' or 'NetRange' in whois database)
196.251.64.0 - 196.251.127.255
last_activity
2026-11-03 16:45:50
last_warden_event
2026-11-03 16:45:50
rep
0.04256508225014821
reserved_range
0
Shodan's InternetDB
Open ports: 22, 80
Tags: –
CPEs: cpe:/a:f5:nginx, cpe:/o:canonical:ubuntu_linux, cpe:/a:openbsd:openssh:8.9p1
ts_added
2026-08-28 07:15:54.492000
ts_last_update
2026-11-03 16:46:57.756000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses