IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

213.209.157.6 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-10-09 01:52:39.300000
Was present on blacklist at: 2025-08-21 01:52, 2025-08-28 01:52, 2025-09-04 01:52, 2025-09-11 01:52, 2025-09-18 01:52, 2025-09-25 01:52, 2025-10-02 01:52, 2025-10-09 01:52

Spamhaus DROP

213.209.157.6 is listed on the Spamhaus DROP blacklist.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-10-09 01:52:39.300000
Was present on blacklist at: 2025-08-28 01:52, 2025-09-04 01:52, 2025-09-11 01:52, 2025-09-18 01:52, 2025-09-25 01:52, 2025-10-02 01:52, 2025-10-09 01:52

AbuseIPDB

213.209.157.6 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2025-10-09 04:00:00.837000
Was present on blacklist at: 2025-09-22 04:00, 2025-09-26 04:00, 2025-10-09 04:00

Spamhaus XBL CBL

213.209.157.6 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-10-09 01:52:39.300000
Was present on blacklist at: 2025-09-25 01:52

FireHOL anonymizers

213.209.157.6 is listed on the FireHOL anonymizers blacklist.

Description: List of anonymizing IPs, aggregated from multiple lists by FireHOL.
Type of feed: secondary (feed detail page)

Last checked at: 2025-10-10 00:05:08
Was present on blacklist at: 2025-10-04 00:05, 2025-10-05 00:05, 2025-10-06 00:05, 2025-10-07 00:05, 2025-10-08 00:05, 2025-10-09 00:05, 2025-10-10 00:05

Warden events (168)

2025-10-02: ReconScanning (node.9c1411): 1
2025-10-01: ReconScanning (node.368407): 25; ReconScanning (node.4dc198): 11
2025-09-30: ReconScanning (node.368407): 43; ReconScanning (node.4dc198): 24
2025-09-26: AnomalyTraffic (node.ffe95c): 3; ReconScanning (node.4dc198): 10
2025-09-22: ReconScanning (node.368407): 11
2025-09-21: ReconScanning (node.368407): 5
2025-09-20: ReconScanning (node.368407): 12
2025-08-22: AttemptLogin (node.ce2b59): 11
2025-08-21: AttemptLogin (node.ce2b59): 12

DShield reports (IP summary, reports)

2025-08-20: Number of reports: 162; Distinct targets: 89
2025-08-21: Number of reports: 10598; Distinct targets: 659
2025-08-22: Number of reports: 10637; Distinct targets: 664
2025-08-23: Number of reports: 10290; Distinct targets: 659
2025-08-24: Number of reports: 2734; Distinct targets: 611
2025-08-27: Number of reports: 6763; Distinct targets: 610
2025-08-28: Number of reports: 10469; Distinct targets: 619
2025-08-29: Number of reports: 9500; Distinct targets: 598
2025-08-30: Number of reports: 9787; Distinct targets: 600
2025-08-31: Number of reports: 9638; Distinct targets: 601
2025-09-01: Number of reports: 9296; Distinct targets: 602
2025-09-02: Number of reports: 9118; Distinct targets: 617
2025-09-03: Number of reports: 2243; Distinct targets: 558
2025-09-05: Number of reports: 4571; Distinct targets: 472
2025-09-06: Number of reports: 9818; Distinct targets: 533
2025-09-07: Number of reports: 9686; Distinct targets: 527
2025-09-08: Number of reports: 9300; Distinct targets: 517
2025-09-09: Number of reports: 7111; Distinct targets: 515
2025-09-19: Number of reports: 12; Distinct targets: 6
2025-09-20: Number of reports: 47; Distinct targets: 25
2025-09-21: Number of reports: 49; Distinct targets: 28
2025-09-25: Number of reports: 201; Distinct targets: 69
2025-09-26: Number of reports: 43; Distinct targets: 31
2025-10-03: Number of reports: 224; Distinct targets: 73
2025-10-09: Number of reports: 187; Distinct targets: 138

Origin AS: AS214943 - RAILNET; AS214940 - KPRONET
BGP Prefix: 213.209.157.0/24
geo: Germany; 🕑 Europe/Berlin
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 213.209.128.0 - 213.209.159.255
last_activity: 2025-10-02 00:07:39
last_warden_event: 2025-10-02 00:07:39
rep: 0.07857142857142857
reserved_range: 0
Shodan's InternetDB: Open ports: 135, 139, 3389, 47001; Tags: self-signed; CPEs: –
ts_added: 2025-08-21 01:52:28.423000
ts_last_update: 2025-10-10 05:02:31.225000

Warden event timeline

DShield event timeline

Presence on blacklists