IP address
Tags:
Residential proxy
IP in hostname
- IP blacklists
Echelon config file hunt
95.111.205.20 was recently listed on the Echelon config file hunt blacklist, but currently it is not.
Description: IPs detected by Echelon sensors (honeypots) as performing this activity: Scanning for exposed configuration files
Type of feed:
primary (
feed detail page)
Last checked at:
2026-10-31 10:10:00.818000
Was present on blacklist at:
2026-10-25 10:10,
2026-10-26 10:10,
2026-10-27 10:10,
2026-10-28 10:10,
2026-10-29 10:10,
2026-10-30 10:10,
2026-10-31 10:10
Echelon TLS/SSL crawler
95.111.205.20 was recently listed on the Echelon TLS/SSL crawler blacklist, but currently it is not.
Description: IPs detected by Echelon sensors (honeypots) as performing this activity: TLS/SSL connection fingerprinting detected via Suricata
Type of feed:
primary (
feed detail page)
Last checked at:
2026-10-31 10:40:00.915000
Was present on blacklist at:
2026-10-25 10:40,
2026-10-26 10:40,
2026-10-27 10:40,
2026-10-28 10:40,
2026-10-29 10:40,
2026-10-30 10:40,
2026-10-31 10:40
Echelon web crawler
95.111.205.20 was recently listed on the Echelon web crawler blacklist, but currently it is not.
Description: IPs detected by Echelon sensors (honeypots) as performing this activity: HTTP web crawling activity detected on web honeypots
Type of feed:
primary (
feed detail page)
Last checked at:
2026-10-31 10:50:00.689000
Was present on blacklist at:
2026-10-25 10:50,
2026-10-26 10:50,
2026-10-27 10:50,
2026-10-28 10:50,
2026-10-29 10:50,
2026-10-30 10:50,
2026-10-31 10:50
Threat categories
| TL | Role | Category | Details |
|---|
| 44 |
src |
scan |
|
- Residential proxy info (data provided by Layer3 Intel)
- Last seen: 2026-10-09 13:29:38}
- Percent days seen: 26 %
- Networks: INFATICA, BYTEFUL, PROXY-SELLER, NODEPROXY, GSOCKS, GEONIX
- Details: https://layer3intel.com/context/95.111.205.20
- Origin AS
- AS202053 - UPCLOUD
- BGP Prefix
- 95.111.204.0/22
- geo
-
Sweden, Stockholm
- 🕑 Europe/Stockholm
- hostname
- 95-111-205-20.se-sto1.upcloud.host
- hostname_class
- ['ip_in_hostname']
- Address block ('inetnum' or 'NetRange' in whois database)
- 95.111.192.0 - 95.111.223.255
- rep
- 0.0
- reserved_range
- 0
- Shodan's InternetDB
- Open ports: 443, 8880
- Tags: self-signed
- CPEs: cpe:/a:google:web_server
- ts_added
- 2026-10-25 10:10:04.607000
- ts_last_update
- 2026-11-03 10:10:12.002000
Warden event timeline
DShield event timeline
Presence on blacklists
