IP address

Passive DNS

Tags: Scanner

IP blacklists

Spamhaus SBL

64.89.163.241 is listed on the Spamhaus SBL blacklist.

Description: The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-04-06 14:12:50.144000
Was present on blacklist at: 2026-02-23 14:12, 2026-03-02 14:12, 2026-03-09 23:13, 2026-03-16 14:12, 2026-03-23 14:12, 2026-03-30 14:12, 2026-04-06 14:12

Spamhaus DROP

64.89.163.241 is listed on the Spamhaus DROP blacklist.

Description: Spamhaus DROP (Don't Route Or Peer) list. Netblocks controlled by spammers or cyber criminals. The DROP lists are a tiny subset of the SBL, designed for use by firewalls and routing equipment to filter out the malicious traffic from these netblocks.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-04-06 14:12:50.144000
Was present on blacklist at: 2026-02-23 14:12, 2026-03-02 14:12, 2026-03-09 23:13, 2026-03-16 14:12, 2026-03-23 14:12, 2026-03-30 14:12, 2026-04-06 14:12

AbuseIPDB

64.89.163.241 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-03-28 05:00:00.605000
Was present on blacklist at: 2026-02-25 05:00, 2026-02-26 05:00, 2026-02-27 05:00, 2026-02-28 05:00, 2026-03-01 05:00, 2026-03-02 05:00, 2026-03-04 05:00, 2026-03-05 05:00, 2026-03-10 05:00, 2026-03-11 05:00, 2026-03-13 05:00, 2026-03-14 05:00, 2026-03-15 05:00, 2026-03-16 05:00, 2026-03-19 05:00, 2026-03-20 05:00, 2026-03-21 05:00, 2026-03-22 05:00, 2026-03-23 05:00, 2026-03-24 05:00, 2026-03-25 05:00, 2026-03-28 05:00

blocklist.de bots

64.89.163.241 is listed on the blocklist.de bots blacklist.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing attacks on the RFI-Attacks,<br>REG-Bots, IRC-Bots or BadBots.
Type of feed: primary (feed detail page)

Last checked at: 2026-03-29 16:05:00.140000
Was present on blacklist at: 2026-03-25 11:05, 2026-03-25 17:05, 2026-03-25 23:05, 2026-03-26 05:05, 2026-03-26 11:05, 2026-03-26 17:05, 2026-03-26 23:05, 2026-03-27 05:05, 2026-03-27 11:05, 2026-03-27 17:05, 2026-03-27 23:05, 2026-03-28 05:05, 2026-03-28 11:05, 2026-03-28 17:05, 2026-03-28 23:05, 2026-03-29 04:05, 2026-03-29 10:05, 2026-03-29 16:05

Echelon web crawler

64.89.163.241 is listed on the Echelon web crawler blacklist.

Description: HTTP web crawling activity detected on web honeypots
Type of feed: primary (feed detail page)

Last checked at: 2026-04-02 09:50:00.545000
Was present on blacklist at: 2026-03-26 10:50, 2026-03-27 10:50, 2026-03-28 10:50, 2026-03-29 09:50, 2026-03-30 09:50, 2026-03-31 09:50, 2026-04-01 09:50, 2026-04-02 09:50

Spamhaus XBL CBL

64.89.163.241 was recently listed on the Spamhaus XBL CBL blacklist, but currently it is not.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-04-06 14:12:50.144000
Was present on blacklist at: 2026-03-30 14:12

Threat categories

TL	Role	Category	Details
47	src	scan	port: 21, 80
45	src	—

Warden events (5429)

2026-03-28: ReconScanning (node.ce2b59): 13
2026-03-27: ReconScanning (node.ce2b59): 32
2026-03-26: ReconScanning (node.ce2b59): 32
2026-03-25: ReconScanning (node.4dc198): 84; ReconScanning (node.368407): 34; ReconScanning (node.ce2b59): 17
2026-03-24: ReconScanning (node.4dc198): 216; ReconScanning (node.368407): 16
2026-03-23: ReconScanning (node.4dc198): 100; ReconScanning (node.368407): 20
2026-03-22: ReconScanning (node.368407): 169; ReconScanning (node.4dc198): 251
2026-03-21: ReconScanning (node.4dc198): 197; ReconScanning (node.368407): 182
2026-03-20: ReconScanning (node.4dc198): 269; ReconScanning (node.368407): 248
2026-03-19: ReconScanning (node.368407): 259; ReconScanning (node.4dc198): 55
2026-03-18: ReconScanning (node.368407): 92; ReconScanning (node.4dc198): 35
2026-03-16: ReconScanning (node.4dc198): 51
2026-03-15: ReconScanning (node.4dc198): 28
2026-03-13: ReconScanning (node.4dc198): 20
2026-03-12: ReconScanning (node.4dc198): 77
2026-03-11: ReconScanning (node.4dc198): 216
2026-03-10: ReconScanning (node.4dc198): 137
2026-03-09: ReconScanning (node.4dc198): 247
2026-03-08: ReconScanning (node.4dc198): 199
2026-03-07: ReconScanning (node.4dc198): 187
2026-03-06: ReconScanning (node.4dc198): 12
2026-03-05: ReconScanning (node.4dc198): 70
2026-03-04: ReconScanning (node.4dc198): 166
2026-03-03: ReconScanning (node.4dc198): 262
2026-03-02: ReconScanning (node.4dc198): 244
2026-03-01: ReconScanning (node.4dc198): 278
2026-02-28: ReconScanning (node.4dc198): 68
2026-02-27: ReconScanning (node.4dc198): 71
2026-02-26: ReconScanning (node.4dc198): 122
2026-02-25: ReconScanning (node.4dc198): 256
2026-02-24: ReconScanning (node.4dc198): 281
2026-02-23: ReconScanning (node.4dc198): 116

DShield reports (IP summary, reports)

2026-02-24: Number of reports: 152; Distinct targets: 87
2026-02-25: Number of reports: 152; Distinct targets: 87
2026-02-26: Number of reports: 141; Distinct targets: 83
2026-02-27: Number of reports: 92; Distinct targets: 61
2026-02-28: Number of reports: 126; Distinct targets: 76
2026-03-01: Number of reports: 87; Distinct targets: 58
2026-03-02: Number of reports: 104; Distinct targets: 67
2026-03-03: Number of reports: 81; Distinct targets: 58
2026-03-04: Number of reports: 83; Distinct targets: 57
2026-03-05: Number of reports: 83; Distinct targets: 57
2026-03-09: Number of reports: 207; Distinct targets: 110
2026-03-10: Number of reports: 152; Distinct targets: 91
2026-03-11: Number of reports: 156; Distinct targets: 95
2026-03-12: Number of reports: 115; Distinct targets: 65
2026-03-13: Number of reports: 115; Distinct targets: 65
2026-03-14: Number of reports: 84; Distinct targets: 55
2026-03-15: Number of reports: 121; Distinct targets: 74
2026-03-16: Number of reports: 221; Distinct targets: 117
2026-03-18: Number of reports: 176; Distinct targets: 102
2026-03-19: Number of reports: 462; Distinct targets: 167
2026-03-20: Number of reports: 453; Distinct targets: 173
2026-03-21: Number of reports: 397; Distinct targets: 169
2026-03-22: Number of reports: 450; Distinct targets: 172
2026-03-23: Number of reports: 268; Distinct targets: 141
2026-03-24: Number of reports: 268; Distinct targets: 141
2026-03-25: Number of reports: 379; Distinct targets: 189
2026-03-26: Number of reports: 379; Distinct targets: 189
2026-03-27: Number of reports: 264; Distinct targets: 91
2026-03-28: Number of reports: 92; Distinct targets: 38
2026-03-29: Number of reports: 92; Distinct targets: 38

Origin AS: AS401626 - NETIFACE-TORONTO
BGP Prefix: 64.89.163.0/24
geo: United Kingdom; 🕑 Europe/London
hostname: (null)
Address block ('inetnum' or 'NetRange' in whois database): 64.89.160.0 - 64.89.163.255
last_activity: 2026-03-28 09:33:03
last_warden_event: 2026-03-28 09:33:03
rep: 0.08094947451636905
reserved_range: 0
Shodan's InternetDB: Open ports: 22, 53, 80; Tags: scanner; CPEs: cpe:/a:apache:http_server:2.4.41, cpe:/o:canonical:ubuntu_linux, cpe:/a:openbsd:openssh:8.2p1
ts_added: 2026-02-23 14:12:48.148000
ts_last_update: 2026-04-06 14:12:50.467000

Warden event timeline

DShield event timeline

Presence on blacklists