IP address

Passive DNS

Tags: Residential proxy IP in hostname

IP blacklists

Spamhaus SBL CSS

37.252.87.217 was recently listed on the Spamhaus SBL CSS blacklist, but currently it is not.

Description: The Spamhaus CSS is part of the SBL. CSS listings will have return code 127.0.0.3 to differentiate from regular SBL listings, which have return code 127.0.0.2.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-11-11 20:12:00.188000
Was present on blacklist at: 2026-08-19 20:12

Spamhaus XBL CBL

37.252.87.217 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-11-11 20:12:00.188000
Was present on blacklist at: 2026-08-19 20:12, 2026-08-26 20:12

AbuseIPDB

37.252.87.217 was recently listed on the AbuseIPDB blacklist, but currently it is not.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-09-09 04:00:00.636000
Was present on blacklist at: 2026-09-09 04:00

UCEPROTECT L1

37.252.87.217 was recently listed on the UCEPROTECT L1 blacklist, but currently it is not.

Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed: primary (feed detail page)

Last checked at: 2026-11-05 08:45:00.825000
Was present on blacklist at: 2026-10-09 15:45, 2026-10-09 23:45, 2026-10-10 07:45, 2026-10-10 15:45, 2026-10-10 23:45, 2026-10-11 07:45, 2026-10-11 15:45, 2026-10-11 23:45, 2026-10-12 07:45, 2026-10-12 15:45, 2026-10-12 23:45, 2026-10-13 07:45, 2026-10-13 15:45, 2026-10-13 23:45, 2026-10-14 07:45, 2026-10-14 15:45, 2026-10-14 23:45, 2026-10-15 07:45, 2026-10-15 15:45, 2026-10-15 23:45, 2026-10-16 07:45, 2026-10-17 15:45, 2026-10-20 15:45, 2026-11-05 00:45, 2026-11-05 08:45

Echelon SSH connection attempt

37.252.87.217 was recently listed on the Echelon SSH connection attempt blacklist, but currently it is not.

Description: IPs detected by Echelon sensors (honeypots) as performing this activity: SSH connection attempt detected on port 22 or 2222
Type of feed: primary (feed detail page)

Last checked at: 2026-10-17 09:35:01.169000
Was present on blacklist at: 2026-10-10 09:35, 2026-10-11 09:35, 2026-10-12 09:35, 2026-10-13 09:35, 2026-10-14 09:35, 2026-10-15 09:35, 2026-10-16 09:35, 2026-10-17 09:35

Threat categories

TL	Role	Category	Details
38	src	—

Warden events (457)

2026-10-25: ReconScanning (node.ce2b59): 12
2026-10-24: ReconScanning (node.ce2b59): 26
2026-10-23: ReconScanning (node.ce2b59): 4
2026-10-13: ReconScanning (node.ce2b59): 3; ReconScanning (node.9c1411): 2
2026-10-12: ReconScanning (node.ce2b59): 31; ReconScanning (node.9c1411): 9
2026-10-11: ReconScanning (node.ce2b59): 28; ReconScanning (node.9c1411): 6
2026-10-10: ReconScanning (node.ce2b59): 26; ReconScanning (node.9c1411): 18
2026-10-09: ReconScanning (node.ce2b59): 34; ReconScanning (node.9c1411): 12
2026-10-08: ReconScanning (node.ce2b59): 22; ReconScanning (node.9c1411): 4
2026-09-29: ReconScanning (node.ce2b59): 2
2026-09-27: ReconScanning (node.ce2b59): 2
2026-09-26: ReconScanning (node.ce2b59): 10
2026-09-23: ReconScanning (node.ce2b59): 14
2026-09-22: ReconScanning (node.ce2b59): 8
2026-09-21: ReconScanning (node.ce2b59): 10
2026-09-20: ReconScanning (node.ce2b59): 9
2026-09-10: ReconScanning (node.ce2b59): 7; ReconScanning (node.9c1411): 3
2026-09-09: ReconScanning (node.ce2b59): 9; ReconScanning (node.9c1411): 4
2026-09-08: ReconScanning (node.ce2b59): 13; ReconScanning (node.9c1411): 9
2026-09-05: ReconScanning (node.ce2b59): 11; ReconScanning (node.9c1411): 5
2026-09-04: ReconScanning (node.9c1411): 2; ReconScanning (node.ce2b59): 2
2026-09-02: ReconScanning (node.ce2b59): 12
2026-09-01: ReconScanning (node.9c1411): 2; ReconScanning (node.ce2b59): 3
2026-08-31: ReconScanning (node.ce2b59): 10
2026-08-28: ReconScanning (node.ce2b59): 2
2026-08-25: ReconScanning (node.9c1411): 1
2026-08-23: ReconScanning (node.9c1411): 5
2026-08-21: ReconScanning (node.ce2b59): 4
2026-08-20: ReconScanning (node.9c1411): 6; ReconScanning (node.ce2b59): 2
2026-08-19: ReconScanning (node.ce2b59): 5; ReconScanning (node.9c1411): 4
2026-08-18: ReconScanning (node.ce2b59): 13; ReconScanning (node.9c1411): 1
2026-08-17: ReconScanning (node.9c1411): 4; ReconScanning (node.ce2b59): 9
2026-08-16: ReconScanning (node.ce2b59): 10; AttemptLogin (node.9c160c): 1; ReconScanning (node.9c1411): 6

DShield reports (IP summary, reports)

2026-08-18: Number of reports: 12; Distinct targets: 6
2026-08-19: Number of reports: 12; Distinct targets: 6
2026-09-20: Number of reports: 16; Distinct targets: 6
2026-09-26: Number of reports: 10; Distinct targets: 4
2026-09-27: Number of reports: 10; Distinct targets: 4
2026-10-08: Number of reports: 26; Distinct targets: 13
2026-10-09: Number of reports: 18; Distinct targets: 7
2026-10-12: Number of reports: 12; Distinct targets: 6

Residential proxy info (data provided by Layer3 Intel)

Last seen: 2026-08-21 09:07:27}

Percent days seen: 50 %

Networks: BOTTINGTOOLS, 711PROXY, LEMONBRIGHT, KOOKEY, NOVADA, GLORYCLOUD, B2PROXY, CLIPROXY, TALORDATA, ROLAPROXY, IPFLY

Details: https://layer3intel.com/context/37.252.87.217

Origin AS: AS44395 - ORG-UL31-RIPE
BGP Prefix: 37.252.87.0/24
geo: Armenia, Yerevan; 🕑 Asia/Yerevan
hostname: host-217.87.252.37.ucom.am
hostname_class: ['ip_in_hostname']
Address block ('inetnum' or 'NetRange' in whois database): 37.252.64.0 - 37.252.95.255
last_activity: 2026-10-25 04:59:09
last_warden_event: 2026-10-25 04:59:09
rep: 0.0
reserved_range: 0
Shodan's InternetDB: Open ports: 3389; Tags: –; CPEs: –
ts_added: 2026-08-12 20:11:51.925000
ts_last_update: 2026-11-14 20:12:00.121000

Warden event timeline

DShield event timeline

Presence on blacklists