IP address

Search at other sites:

.23577.56.216.25377-56-216-253.dclient.hispeed.ch

Shodan(more info)

Passive DNS

IP blacklists

Spamhaus PBL ISP

77.56.216.253 was recently listed on the Spamhaus PBL ISP blacklist, but currently it is not.

Description: The Spamhaus PBL is a DNSBL database of end-user IP address ranges which should not be delivering unauthenticated SMTP email to any Internet mail server except those provided for specifically by an ISP for that customer's use.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2026-11-08 21:51:00.436000
Was present on blacklist at: 2026-11-01 21:50, 2026-11-08 21:51

Echelon SSH connection attempt

77.56.216.253 is listed on the Echelon SSH connection attempt blacklist.

Description: IPs detected by Echelon sensors (honeypots) as performing this activity: SSH connection attempt detected on port 22 or 2222
Type of feed: primary (feed detail page)

Last checked at: 2026-11-14 10:35:00.723000
Was present on blacklist at: 2026-11-14 10:35

Threat categories

TL	Role	Category	Details
49	src	scan	port: 22, 23
25	src	login	protocol: ssh port: 22, 2222

---

Warden events (45)

2026-11-15

ReconScanning (node.ce2b59): 1

2026-11-14

ReconScanning (node.ce2b59): 24

ReconScanning (node.9c1411): 3

2026-11-13

ReconScanning (node.ce2b59): 3

2026-11-12

ReconScanning (node.ce2b59): 3

ReconScanning (node.9c1411): 1

2026-11-05

ReconScanning (node.9c1411): 2

ReconScanning (node.ce2b59): 5

2026-11-04

ReconScanning (node.9c1411): 2

2026-11-01

ReconScanning (node.41e9fa): 1

OTX pulses

[6af8f9c07ea51c3a5e3c3c88] 2026-11-15 00:16:00.858000 | Honeypot sg1 - SSH/Telnet/Web attackers and malware delivery - 2026-11-14

Author name:	jrnetsec
TLP:	clear
Pulse modified:	2026-11-15 00:16:00.858000
Indicator created:	2026-11-15 00:16:01
Indicator role:	scanning_host
Indicator title:	Scanner - SSH/Telnet
Indicator expiration:	2026-12-15 00:00:00

Origin AS

AS6730 - SUNRISE

BGP Prefix

77.56.0.0/15

geo

Switzerland, Neuchâtel

🕑 Europe/Zurich

hostname

77-56-216-253.dclient.hispeed.ch

hostname_class

['ip_in_hostname']

Address block ('inetnum' or 'NetRange' in whois database)

77.56.0.0 - 77.59.255.255

last_activity

2026-11-15 05:44:58.565000

last_warden_event

2026-11-14 23:54:57

rep

0.2348102083372584

reserved_range

0

Shodan's InternetDB

Open ports: 3389, 5060

Tags: self-signed

CPEs: –

ts_added

2026-11-01 21:50:55.972000

ts_last_update

2026-11-15 05:44:58.581000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses