ScotNet DNSBL • Transparency

Transparency snapshot

Back to DNSBL

Active listings

2,633

Live from BIND zone (A + AAAA)

Threat activity (7 days)

Unique suspicious public IPs • 1,555 matched events • 3,834 requests evaluated

Repeat offenders

118

Threatmail: 69 • Apache security: 49

Lifecycle

Active

Pending review: 0 • Expiring ≤7d: 31 • Expired last run: 0

Delisted records

1 in the last 7 days • unique IPs with a recorded delist

Mail feeds

Active

Threatmail: active
User reports: not enabled • last 2026-06-24 11:55 BST

History coverage

69.9%

1,840 of 2,633 live listings have metadata

Last zone update

2026-06-24 11:50 BST

Authoritative BIND zone last modified

Live status, return code and TXT reason are reconciled directly against the BIND zone. An address is marked DELISTED only when a real delist timestamp, counter or audit event exists; otherwise a non-live historical address is OBSERVED. Repeat-offender totals are grouped by the latest sanitised attack source; complete event history is available only through the per-IP JSON feed and delist information. Apache activity cache updated 2026-06-24 11:55 BST.
BIND records: IPv4 A = 2,633 • IPv6 AAAA = 0 • TXT = 2,633 • SOA serial 2026062417.

Listings history

Live BIND entries plus observation and delisting history. Times use UK local GMT/BST.

Search Source Code Rows Clear

Showing 201–300 of 2,633 matching records.

IP	Status	Code	Reason	Last activity	Sources	Lists / Delists
41.75.114.30	LISTED	127.0.0.4	Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt	20 Jun 22:35 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt First observed 2026-06-20 22:30:23 BST Last observed 2026-06-20 22:30:20 BST First listed 2026-06-20 22:35:04 BST Last listed 2026-06-20 22:35:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 22:30:20 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
66.132.172.239	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 22:30 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 22:27:38 BST Last observed 2026-06-20 22:27:38 BST First listed 2026-06-20 22:30:04 BST Last listed 2026-06-20 22:30:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 22:27:38 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
69.5.169.10	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 22:25 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 22:22:21 BST Last observed 2026-06-20 22:22:21 BST First listed 2026-06-20 22:25:05 BST Last listed 2026-06-20 22:25:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 22:22:21 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
83.226.37.149	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 120	20 Jun 22:15 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 120 First observed 2026-06-20 22:11:31 BST Last observed 2026-06-20 22:11:31 BST First listed 2026-06-20 22:15:04 BST Last listed 2026-06-20 22:15:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 22:11:31 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
34.65.251.190	LISTED	127.0.0.4	Threat Prevention: Web Application Attack / ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016)	20 Jun 21:35 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Web Application Attack / ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) First observed 2026-06-20 21:32:17 BST Last observed 2026-06-20 21:32:17 BST First listed 2026-06-20 21:35:04 BST Last listed 2026-06-20 21:35:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 21:32:17 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.84.117.189	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 30	20 Jun 21:30 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 30 First observed 2026-06-20 21:27:42 BST Last observed 2026-06-20 21:27:42 BST First listed 2026-06-20 21:30:06 BST Last listed 2026-06-20 21:30:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 21:27:42 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
199.45.154.121	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 21:10 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 21:09:35 BST Last observed 2026-06-20 21:09:35 BST First listed 2026-06-20 21:10:04 BST Last listed 2026-06-20 21:10:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 21:09:35 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
66.132.172.214	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 20:45 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 20:42:47 BST Last observed 2026-06-20 20:42:47 BST First listed 2026-06-20 20:45:04 BST Last listed 2026-06-20 20:45:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 20:42:47 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
205.210.31.111	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 20:40 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 20:35:17 BST Last observed 2026-06-20 20:35:17 BST First listed 2026-06-20 20:40:03 BST Last listed 2026-06-20 20:40:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 20:35:17 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
212.227.235.203	LISTED	127.0.0.4	Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt	20 Jun 20:30 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt First observed 2026-06-20 20:27:15 BST Last observed 2026-06-20 20:27:15 BST First listed 2026-06-20 20:30:04 BST Last listed 2026-06-20 20:30:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 20:27:15 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
198.235.24.47	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 19:20 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 19:17:48 BST Last observed 2026-06-20 19:17:48 BST First listed 2026-06-20 19:20:03 BST Last listed 2026-06-20 19:20:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 19:17:48 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
18.218.118.203	LISTED	127.0.0.4	Threat Prevention: Attempted Information Leak / ET SCAN MS Terminal Server Traffic on Non-standard Port	20 Jun 19:15 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Attempted Information Leak / ET SCAN MS Terminal Server Traffic on Non-standard Port First observed 2026-02-11 19:08:46 GMT Last observed 2026-06-20 19:11:38 BST First listed 2026-06-20 00:00:07 BST Last listed 2026-06-20 19:15:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 19:11:38 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
100.49.117.77	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 18:40 BST	threatmail	8 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-05 17:05:48 BST Last observed 2026-06-20 18:38:05 BST First listed 2026-06-05 17:05:48 BST Last listed 2026-06-20 18:40:04 BST Last delisted — Last expired — Evidence expiry 2026-09-18 18:38:05 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.8 Lists / Delists 8 / 0 Sanitised history JSON feed
205.210.31.249	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 18:30 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-10 22:15:04 BST Last observed 2026-06-20 18:28:32 BST First listed 2026-06-10 22:15:04 BST Last listed 2026-06-20 18:30:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 18:28:32 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
176.65.139.237	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 18:25 BST	apache-security threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-05-26 09:20:14 BST Last observed 2026-06-20 18:21:35 BST First listed 2026-06-20 00:25:09 BST Last listed 2026-06-20 18:25:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 18:21:35 BST Confidence 85/100 high Sources apache-security threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
5.61.209.43	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 17:15 BST	threatmail	44 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-10 08:47:39 BST Last observed 2026-06-20 17:13:44 BST First listed 2026-06-12 02:30:04 BST Last listed 2026-06-20 17:15:05 BST Last delisted — Last expired — Evidence expiry 2026-09-18 17:13:44 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.8 Lists / Delists 44 / 0 Sanitised history JSON feed
40.74.208.9	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 51	20 Jun 16:55 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 51 First observed 2026-06-20 16:52:18 BST Last observed 2026-06-20 16:52:18 BST First listed 2026-06-20 16:55:05 BST Last listed 2026-06-20 16:55:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 16:52:18 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
45.205.1.243	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 16:40 BST	threatmail	21 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-01 14:28:31 BST Last observed 2026-06-20 16:38:41 BST First listed 2026-06-05 13:24:09 BST Last listed 2026-06-20 16:40:04 BST Last delisted — Last expired — Evidence expiry 2026-09-18 16:38:41 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.8 Lists / Delists 21 / 0 Sanitised history JSON feed
45.79.138.233	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 60	20 Jun 16:20 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 60 First observed 2026-06-20 16:15:44 BST Last observed 2026-06-20 16:15:44 BST First listed 2026-06-20 16:20:03 BST Last listed 2026-06-20 16:20:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 16:15:44 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
198.235.24.150	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 16:10 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 16:05:00 BST Last observed 2026-06-20 16:05:00 BST First listed 2026-06-20 16:10:04 BST Last listed 2026-06-20 16:10:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 16:05:00 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
206.189.120.50	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 282	20 Jun 15:45 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 282 First observed 2026-06-20 15:41:59 BST Last observed 2026-06-20 15:41:59 BST First listed 2026-06-20 15:45:07 BST Last listed 2026-06-20 15:45:07 BST Last delisted — Last expired — Evidence expiry 2026-07-20 15:41:59 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
71.6.165.200	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 113	20 Jun 15:20 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 113 First observed 2026-06-20 15:17:30 BST Last observed 2026-06-20 15:17:30 BST First listed 2026-06-20 15:20:05 BST Last listed 2026-06-20 15:20:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 15:17:30 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
146.190.37.241	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 192	20 Jun 14:55 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 192 First observed 2026-06-13 16:33:04 BST Last observed 2026-06-20 14:51:48 BST First listed 2026-06-13 15:35:06 BST Last listed 2026-06-20 14:55:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 14:51:48 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
91.230.168.204	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 14:35 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 14:31:38 BST Last observed 2026-06-20 14:31:38 BST First listed 2026-06-20 14:35:06 BST Last listed 2026-06-20 14:35:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 14:31:38 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
91.230.168.97	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 134	20 Jun 14:30 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 134 First observed 2026-06-05 16:40:38 BST Last observed 2026-06-20 14:29:01 BST First listed 2026-06-05 16:40:38 BST Last listed 2026-06-20 14:30:08 BST Last delisted — Last expired — Evidence expiry 2026-07-20 14:29:01 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
193.163.125.144	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 14:10 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-05 17:26:51 BST Last observed 2026-06-20 14:06:48 BST First listed 2026-06-05 17:26:51 BST Last listed 2026-06-20 14:10:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 14:06:48 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
79.124.40.138	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 14:09 BST	threatmail	5 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-14 11:18:56 BST Last observed 2026-06-20 14:09:33 BST First listed 2026-06-14 10:20:03 BST Last listed 2026-06-20 13:10:03 BST Last delisted — Last expired — Evidence expiry 2026-09-18 14:09:33 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.8 Lists / Delists 5 / 0 Sanitised history JSON feed
185.242.226.102	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 14:05 BST	threatmail	10 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-05 17:11:48 BST Last observed 2026-06-20 13:54:46 BST First listed 2026-06-05 17:11:48 BST Last listed 2026-06-20 14:05:05 BST Last delisted — Last expired — Evidence expiry 2026-09-18 13:54:46 BST Confidence 75/100 high Sources threatmail Return code 127.0.0.8 Lists / Delists 10 / 0 Sanitised history JSON feed
198.235.24.179	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 13:59 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 13:59:12 BST Last observed 2026-06-20 13:59:12 BST First listed 2026-06-20 13:00:05 BST Last listed 2026-06-20 13:00:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 13:59:12 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
66.132.186.200	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 13:52 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-03-25 20:03:18 GMT Last observed 2026-06-20 13:52:43 BST First listed 2026-06-20 12:55:08 BST Last listed 2026-06-20 12:55:08 BST Last delisted — Last expired — Evidence expiry 2026-07-20 13:52:43 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
66.132.186.221	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 13:52 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 13:52:00 BST Last observed 2026-06-20 13:52:00 BST First listed 2026-06-20 12:55:06 BST Last listed 2026-06-20 12:55:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 13:52:00 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
40.67.161.44	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 13:50 BST	threatmail	3 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-03-28 16:15:46 GMT Last observed 2026-06-20 13:50:31 BST First listed 2026-06-18 04:35:04 BST Last listed 2026-06-20 12:55:04 BST Last delisted — Last expired — Evidence expiry 2026-09-18 13:50:31 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.8 Lists / Delists 3 / 0 Sanitised history JSON feed
66.132.172.177	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 13:38 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-03-21 15:54:58 GMT Last observed 2026-06-20 13:38:03 BST First listed 2026-06-20 12:40:05 BST Last listed 2026-06-20 12:40:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 13:38:03 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
3.87.27.156	LISTED	127.0.0.8	Apache security: path_traversal	20 Jun 13:25 BST	apache-security	23 / 0
Full evidence / reason Apache security: path_traversal First observed 2026-06-18 13:41:13 BST Last observed 2026-06-20 13:23:45 BST First listed 2026-06-18 13:45:13 BST Last listed 2026-06-20 13:25:12 BST Last delisted — Last expired — Evidence expiry 2026-09-18 13:23:45 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 23 / 0 Sanitised history JSON feed
207.241.173.215	LISTED	127.0.0.4	Threat Prevention: Successful Credential Theft Detected / ET WEB_SPECIFIC_APPS Wordpress LiteSpeed Cache Plugin debug.log Access Attempt (CVE-2024-44000)	20 Jun 13:23 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Successful Credential Theft Detected / ET WEB_SPECIFIC_APPS Wordpress LiteSpeed Cache Plugin debug.log Access Attempt (CVE-2024-44000) First observed 2026-06-20 13:23:19 BST Last observed 2026-06-20 13:23:19 BST First listed 2026-06-20 12:25:04 BST Last listed 2026-06-20 12:25:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 13:23:19 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
3.142.170.60	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 13:17 BST	threatmail	15 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-05 15:52:46 BST Last observed 2026-06-20 13:17:14 BST First listed 2026-06-05 15:52:46 BST Last listed 2026-06-20 12:20:06 BST Last delisted — Last expired — Evidence expiry 2026-09-18 13:17:14 BST Confidence 95/100 very-high Sources threatmail Return code 127.0.0.8 Lists / Delists 15 / 0 Sanitised history JSON feed
74.235.100.195	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 115	20 Jun 13:15 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 115 First observed 2026-04-28 17:43:56 BST Last observed 2026-06-20 13:15:08 BST First listed 2026-06-20 12:20:04 BST Last listed 2026-06-20 12:20:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 13:15:08 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
198.235.24.244	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 12:54 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 12:54:53 BST Last observed 2026-06-20 12:54:53 BST First listed 2026-06-20 12:00:06 BST Last listed 2026-06-20 12:00:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 12:54:53 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
195.3.220.7	LISTED	127.0.0.8	Apache security: shell_backdoor_probe	20 Jun 12:40 BST	apache-security	18 / 0
Full evidence / reason Apache security: shell_backdoor_probe First observed 2026-05-03 03:39:06 BST Last observed 2026-06-20 12:39:50 BST First listed 2026-06-13 15:15:04 BST Last listed 2026-06-20 12:40:17 BST Last delisted — Last expired — Evidence expiry 2026-09-18 12:39:50 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 18 / 0 Sanitised history JSON feed
20.65.193.105	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 33	20 Jun 12:18 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 33 First observed 2026-02-07 16:33:15 GMT Last observed 2026-06-20 12:18:56 BST First listed 2026-06-20 11:20:05 BST Last listed 2026-06-20 11:20:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 12:18:56 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
37.120.213.13	LISTED	127.0.0.4	Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt	20 Jun 12:15 BST	apache-security threatmail	2 / 0
Full evidence / reason Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt First observed 2026-06-05 16:10:57 BST Last observed 2026-06-20 12:11:29 BST First listed 2026-06-05 16:10:57 BST Last listed 2026-06-20 12:15:13 BST Last delisted — Last expired — Evidence expiry 2026-07-20 12:11:29 BST Confidence 85/100 high Sources apache-security threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
217.181.88.165	LISTED	127.0.0.4	Apache security: repeated explicit application probes	20 Jun 11:55 BST	apache-security	1 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-06-20 11:52:25 BST Last observed 2026-06-20 11:52:25 BST First listed 2026-06-20 11:55:16 BST Last listed 2026-06-20 11:55:16 BST Last delisted — Last expired — Evidence expiry 2026-07-20 11:52:25 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
217.181.81.89	LISTED	127.0.0.4	Apache security: repeated explicit application probes	20 Jun 11:55 BST	apache-security	1 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-06-20 11:52:23 BST Last observed 2026-06-20 11:52:23 BST First listed 2026-06-20 11:55:15 BST Last listed 2026-06-20 11:55:15 BST Last delisted — Last expired — Evidence expiry 2026-07-20 11:52:23 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.83.32.170	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 30	20 Jun 11:49 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 30 First observed 2026-06-20 11:49:58 BST Last observed 2026-06-20 11:49:58 BST First listed 2026-06-20 10:55:05 BST Last listed 2026-06-20 10:55:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 11:49:58 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
69.5.169.41	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 11:48 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 11:48:42 BST Last observed 2026-06-20 11:48:42 BST First listed 2026-06-20 10:50:08 BST Last listed 2026-06-20 10:50:08 BST Last delisted — Last expired — Evidence expiry 2026-07-20 11:48:42 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
91.230.121.134	LISTED	127.0.0.8	Apache security: framework_exploit_probe	20 Jun 11:30 BST	apache-security	9 / 0
Full evidence / reason Apache security: framework_exploit_probe First observed 2026-06-14 16:16:19 BST Last observed 2026-06-20 11:29:48 BST First listed 2026-06-14 16:20:12 BST Last listed 2026-06-20 11:30:18 BST Last delisted — Last expired — Evidence expiry 2026-09-18 11:29:48 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 9 / 0 Sanitised history JSON feed
20.251.117.149	LISTED	127.0.0.8	Apache security: shell_backdoor_probe	20 Jun 11:20 BST	apache-security	4 / 0
Full evidence / reason Apache security: shell_backdoor_probe First observed 2026-06-17 15:03:18 BST Last observed 2026-06-20 11:17:52 BST First listed 2026-06-17 15:05:11 BST Last listed 2026-06-20 11:20:14 BST Last delisted — Last expired — Evidence expiry 2026-09-18 11:17:52 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 4 / 0 Sanitised history JSON feed
216.180.246.140	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 287	20 Jun 11:19 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 287 First observed 2026-06-20 11:19:47 BST Last observed 2026-06-20 11:19:47 BST First listed 2026-06-20 10:25:04 BST Last listed 2026-06-20 10:25:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 11:19:47 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
85.204.70.106	LISTED	127.0.0.4	Apache security: repeated explicit application probes	20 Jun 11:15 BST	apache-security	1 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-06-20 11:10:11 BST Last observed 2026-06-20 11:10:11 BST First listed 2026-06-20 11:15:18 BST Last listed 2026-06-20 11:15:18 BST Last delisted — Last expired — Evidence expiry 2026-07-20 11:10:11 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
69.5.169.63	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 127	20 Jun 10:47 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 127 First observed 2026-06-16 22:40:20 BST Last observed 2026-06-20 10:47:27 BST First listed 2026-06-16 21:45:03 BST Last listed 2026-06-20 09:50:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:47:27 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
199.45.154.158	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 10:40 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-02-09 03:37:13 GMT Last observed 2026-06-20 10:40:52 BST First listed 2026-06-20 09:45:04 BST Last listed 2026-06-20 09:45:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:40:52 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
74.248.112.30	LISTED	127.0.0.8	Apache security: shell_backdoor_probe	20 Jun 10:35 BST	apache-security	9 / 0
Full evidence / reason Apache security: shell_backdoor_probe First observed 2026-06-17 14:55:38 BST Last observed 2026-06-20 10:32:33 BST First listed 2026-06-17 15:00:15 BST Last listed 2026-06-20 10:35:18 BST Last delisted — Last expired — Evidence expiry 2026-09-18 10:32:33 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 9 / 0 Sanitised history JSON feed
23.251.34.171	LISTED	127.0.0.4	Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt	20 Jun 10:32 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt First observed 2026-06-20 10:32:28 BST Last observed 2026-06-20 10:32:28 BST First listed 2026-06-20 09:35:05 BST Last listed 2026-06-20 09:35:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:32:28 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
221.159.119.6	LISTED	127.0.0.4	Apache security: framework_exploit_probe	20 Jun 10:20 BST	apache-security	2 / 0
Full evidence / reason Apache security: framework_exploit_probe First observed 2026-06-16 03:44:38 BST Last observed 2026-06-20 10:15:19 BST First listed 2026-06-16 03:45:12 BST Last listed 2026-06-20 10:20:15 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:15:19 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
193.163.125.247	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 10:13 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-19 10:33:56 BST Last observed 2026-06-20 10:13:43 BST First listed 2026-06-19 09:35:05 BST Last listed 2026-06-20 09:15:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:13:43 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
193.163.125.70	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 10:07 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-05 19:40:02 BST Last observed 2026-06-20 10:07:54 BST First listed 2026-06-05 19:40:02 BST Last listed 2026-06-20 09:10:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:07:54 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
180.244.187.139	LISTED	127.0.0.4	Apache security: device_api_probe	20 Jun 10:05 BST	apache-security	1 / 0
Full evidence / reason Apache security: device_api_probe First observed 2026-06-20 10:04:00 BST Last observed 2026-06-20 10:04:00 BST First listed 2026-06-20 10:05:09 BST Last listed 2026-06-20 10:05:09 BST Last delisted — Last expired — Evidence expiry 2026-07-20 10:04:00 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
45.156.128.5	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 09:54 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 09:54:15 BST Last observed 2026-06-20 09:54:15 BST First listed 2026-06-20 08:55:05 BST Last listed 2026-06-20 08:55:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:54:15 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.40.216.95	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 25	20 Jun 09:37 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 25 First observed 2026-06-20 09:37:44 BST Last observed 2026-06-20 09:37:44 BST First listed 2026-06-20 08:40:04 BST Last listed 2026-06-20 08:40:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:37:44 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
4.232.80.255	LISTED	127.0.0.8	Apache security: shell_backdoor_probe	20 Jun 09:30 BST	apache-security	8 / 0
Full evidence / reason Apache security: shell_backdoor_probe First observed 2026-06-17 16:01:51 BST Last observed 2026-06-20 09:27:48 BST First listed 2026-06-17 16:05:11 BST Last listed 2026-06-20 09:30:15 BST Last delisted — Last expired — Evidence expiry 2026-09-18 09:27:48 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 8 / 0 Sanitised history JSON feed
185.194.205.18	LISTED	127.0.0.4	Apache security: repeated explicit application probes	20 Jun 09:20 BST	apache-security	2 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-06-20 06:15:48 BST Last observed 2026-06-20 09:15:29 BST First listed 2026-06-20 06:20:14 BST Last listed 2026-06-20 09:20:09 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:15:29 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
47.88.7.35	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 88	20 Jun 09:13 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 88 First observed 2026-06-20 09:13:12 BST Last observed 2026-06-20 09:13:12 BST First listed 2026-06-20 08:15:08 BST Last listed 2026-06-20 08:15:08 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:13:12 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
198.235.24.183	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 09:11 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-04-04 15:08:48 BST Last observed 2026-06-20 09:11:44 BST First listed 2026-06-20 08:15:04 BST Last listed 2026-06-20 08:15:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:11:44 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
66.132.186.176	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 09:05 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-03-30 16:52:56 BST Last observed 2026-06-20 09:05:18 BST First listed 2026-06-20 08:10:04 BST Last listed 2026-06-20 08:10:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:05:18 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
69.5.169.127	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 09:00 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-05-15 15:45:29 BST Last observed 2026-06-20 09:00:25 BST First listed 2026-06-20 08:05:04 BST Last listed 2026-06-20 08:05:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 09:00:25 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
80.94.95.211	LISTED	127.0.0.8	Apache security: repeated explicit application probes	20 Jun 08:55 BST	apache-security	7 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-05-21 23:19:54 BST Last observed 2026-06-20 08:50:46 BST First listed 2026-06-14 08:35:09 BST Last listed 2026-06-20 08:55:20 BST Last delisted — Last expired — Evidence expiry 2026-09-18 08:50:46 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 7 / 0 Sanitised history JSON feed
198.235.24.124	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 08:44 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 08:44:16 BST Last observed 2026-06-20 08:44:16 BST First listed 2026-06-20 07:45:06 BST Last listed 2026-06-20 07:45:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 08:44:16 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
205.210.31.168	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 08:40 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-04-19 09:56:25 BST Last observed 2026-06-20 08:40:58 BST First listed 2026-06-13 13:55:04 BST Last listed 2026-06-20 07:45:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 08:40:58 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
64.62.197.55	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 08:39 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 08:39:51 BST Last observed 2026-06-20 08:39:51 BST First listed 2026-06-20 07:40:04 BST Last listed 2026-06-20 07:40:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 08:39:51 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
167.94.145.28	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 08:12 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 08:12:11 BST Last observed 2026-06-20 08:12:11 BST First listed 2026-06-20 07:15:06 BST Last listed 2026-06-20 07:15:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 08:12:11 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
45.43.58.131	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 59	20 Jun 07:44 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 59 First observed 2026-06-20 07:44:53 BST Last observed 2026-06-20 07:44:53 BST First listed 2026-06-20 06:50:06 BST Last listed 2026-06-20 06:50:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 07:44:53 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.104.244.165	LISTED	127.0.0.8	Apache security: shell_backdoor_probe	20 Jun 07:40 BST	apache-security	5 / 0
Full evidence / reason Apache security: shell_backdoor_probe First observed 2026-06-16 03:02:51 BST Last observed 2026-06-20 07:37:28 BST First listed 2026-06-16 03:05:10 BST Last listed 2026-06-20 07:40:16 BST Last delisted — Last expired — Evidence expiry 2026-09-18 07:37:28 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 5 / 0 Sanitised history JSON feed
205.210.31.64	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 07:11 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 07:11:49 BST Last observed 2026-06-20 07:11:49 BST First listed 2026-06-20 06:15:05 BST Last listed 2026-06-20 06:15:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 07:11:49 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
212.127.91.32	LISTED	127.0.0.4	Apache security: command_injection_probe	20 Jun 06:55 BST	apache-security	1 / 0
Full evidence / reason Apache security: command_injection_probe First observed 2026-06-20 06:52:54 BST Last observed 2026-06-20 06:52:54 BST First listed 2026-06-20 06:55:18 BST Last listed 2026-06-20 06:55:18 BST Last delisted — Last expired — Evidence expiry 2026-07-20 06:52:54 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
172.237.117.50	LISTED	127.0.0.4	Threat Prevention: Attempted Information Leak / ET SCAN MS Terminal Server Traffic on Non-standard Port	20 Jun 06:32 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Attempted Information Leak / ET SCAN MS Terminal Server Traffic on Non-standard Port First observed 2026-06-20 06:32:40 BST Last observed 2026-06-20 06:32:40 BST First listed 2026-06-20 05:35:04 BST Last listed 2026-06-20 05:35:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 06:32:40 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
172.239.117.185	LISTED	127.0.0.4	Apache security: repeated explicit application probes	20 Jun 06:30 BST	apache-security	1 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-04-11 11:24:41 BST Last observed 2026-06-20 06:28:28 BST First listed 2026-06-20 06:30:12 BST Last listed 2026-06-20 06:30:12 BST Last delisted — Last expired — Evidence expiry 2026-07-20 06:28:28 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
216.25.89.101	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 288	20 Jun 06:24 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 288 First observed 2026-06-20 06:24:54 BST Last observed 2026-06-20 06:24:54 BST First listed 2026-06-20 05:30:05 BST Last listed 2026-06-20 05:30:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 06:24:54 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
193.163.125.169	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 05:51 BST	threatmail	2 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-05 17:30:05 BST Last observed 2026-06-20 05:51:37 BST First listed 2026-06-05 17:30:05 BST Last listed 2026-06-20 04:55:03 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:51:37 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
198.235.24.66	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 05:46 BST	threatmail	3 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-05 16:11:27 BST Last observed 2026-06-20 05:46:48 BST First listed 2026-06-05 16:11:27 BST Last listed 2026-06-20 04:50:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:46:48 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 3 / 0 Sanitised history JSON feed
20.206.64.115	LISTED	127.0.0.4	Apache security: distinct 4xx path scan	20 Jun 05:45 BST	apache-security	2 / 0
Full evidence / reason Apache security: distinct 4xx path scan First observed 2026-06-15 18:59:11 BST Last observed 2026-06-20 05:44:23 BST First listed 2026-06-15 19:00:09 BST Last listed 2026-06-20 05:45:14 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:44:23 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 2 / 0 Sanitised history JSON feed
202.183.141.133	LISTED	127.0.0.4	Apache security: path_traversal	20 Jun 05:40 BST	apache-security	1 / 0
Full evidence / reason Apache security: path_traversal First observed 2026-06-20 05:39:10 BST Last observed 2026-06-20 05:39:10 BST First listed 2026-06-20 05:40:15 BST Last listed 2026-06-20 05:40:15 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:39:10 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.151.116.187	LISTED	127.0.0.8	Apache security: shell_backdoor_probe	20 Jun 05:40 BST	apache-security	3 / 0
Full evidence / reason Apache security: shell_backdoor_probe First observed 2026-06-19 14:49:26 BST Last observed 2026-06-20 05:37:36 BST First listed 2026-06-19 14:50:15 BST Last listed 2026-06-20 05:40:12 BST Last delisted — Last expired — Evidence expiry 2026-09-18 05:37:36 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 3 / 0 Sanitised history JSON feed
66.132.172.204	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 05:39 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-08 15:03:20 BST Last observed 2026-06-20 05:39:37 BST First listed 2026-06-20 04:45:04 BST Last listed 2026-06-20 04:45:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:39:37 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
66.132.172.131	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 05:30 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-04-01 10:47:18 BST Last observed 2026-06-20 05:30:40 BST First listed 2026-06-20 04:35:04 BST Last listed 2026-06-20 04:35:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:30:40 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.226.45.125	LISTED	127.0.0.4	Apache security: distinct 4xx path scan	20 Jun 05:30 BST	apache-security	3 / 0
Full evidence / reason Apache security: distinct 4xx path scan First observed 2026-06-19 11:20:09 BST Last observed 2026-06-20 05:27:19 BST First listed 2026-06-19 11:20:17 BST Last listed 2026-06-20 05:30:16 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:27:19 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 3 / 0 Sanitised history JSON feed
176.65.139.140	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 05:28 BST	apache-security threatmail	13 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-05 16:45:53 BST Last observed 2026-06-20 05:28:24 BST First listed 2026-06-05 16:45:53 BST Last listed 2026-06-20 04:30:04 BST Last delisted — Last expired — Evidence expiry 2026-09-18 05:28:24 BST Confidence 95/100 very-high Sources apache-security threatmail Return code 127.0.0.8 Lists / Delists 13 / 0 Sanitised history JSON feed
45.148.10.200	LISTED	127.0.0.8	Apache security: repeated explicit application probes	20 Jun 05:25 BST	apache-security	6 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-06-05 04:29:03 BST Last observed 2026-06-20 05:20:18 BST First listed 2026-06-15 05:50:10 BST Last listed 2026-06-20 05:25:14 BST Last delisted — Last expired — Evidence expiry 2026-09-18 05:20:18 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 6 / 0 Sanitised history JSON feed
110.35.80.116	LISTED	127.0.0.4	Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt	20 Jun 05:25 BST	apache-security threatmail	4 / 0
Full evidence / reason Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt First observed 2026-03-16 20:38:37 GMT Last observed 2026-06-20 05:22:28 BST First listed 2026-06-05 17:15:58 BST Last listed 2026-06-20 05:25:07 BST Last delisted — Last expired — Evidence expiry 2026-07-20 05:22:28 BST Confidence 85/100 high Sources apache-security threatmail Return code 127.0.0.4 Lists / Delists 4 / 0 Sanitised history JSON feed
20.104.203.253	LISTED	127.0.0.8	Apache security: distinct 4xx path scan	20 Jun 04:55 BST	apache-security	4 / 0
Full evidence / reason Apache security: distinct 4xx path scan First observed 2026-06-18 15:34:46 BST Last observed 2026-06-20 04:53:38 BST First listed 2026-06-18 15:35:11 BST Last listed 2026-06-20 04:55:11 BST Last delisted — Last expired — Evidence expiry 2026-09-18 04:53:38 BST Confidence 95/100 very-high Sources apache-security Return code 127.0.0.8 Lists / Delists 4 / 0 Sanitised history JSON feed
198.11.178.150	LISTED	127.0.0.8	Repeat offender: 3 unique events/7d, 3/30d	20 Jun 04:52 BST	apache-security threatmail	4 / 0
Full evidence / reason Repeat offender: 3 unique events/7d, 3/30d First observed 2026-06-15 09:51:11 BST Last observed 2026-06-20 04:52:48 BST First listed 2026-06-15 08:55:04 BST Last listed 2026-06-20 03:55:05 BST Last delisted — Last expired — Evidence expiry 2026-09-18 04:52:48 BST Confidence 95/100 very-high Sources apache-security threatmail Return code 127.0.0.8 Lists / Delists 4 / 0 Sanitised history JSON feed
185.180.141.68	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 251	20 Jun 04:45 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 251 First observed 2026-06-20 04:45:08 BST Last observed 2026-06-20 04:45:08 BST First listed 2026-06-20 03:50:05 BST Last listed 2026-06-20 03:50:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 04:45:08 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
185.180.141.67	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 251	20 Jun 04:43 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 251 First observed 2026-06-20 04:43:21 BST Last observed 2026-06-20 04:43:21 BST First listed 2026-06-20 03:45:04 BST Last listed 2026-06-20 03:45:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 04:43:21 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
212.132.119.238	LISTED	127.0.0.4	Apache security: repeated explicit application probes	20 Jun 04:40 BST	apache-security	1 / 0
Full evidence / reason Apache security: repeated explicit application probes First observed 2026-06-20 04:39:35 BST Last observed 2026-06-20 04:39:35 BST First listed 2026-06-20 04:40:13 BST Last listed 2026-06-20 04:40:13 BST Last delisted — Last expired — Evidence expiry 2026-07-20 04:39:35 BST Confidence 85/100 high Sources apache-security Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
160.250.51.11	LISTED	127.0.0.4	Threat Prevention: Attempted Information Leak / ET EXPLOIT Netgear DGN Remote Command Execution	20 Jun 04:16 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Attempted Information Leak / ET EXPLOIT Netgear DGN Remote Command Execution First observed 2026-06-20 04:16:04 BST Last observed 2026-06-20 04:16:04 BST First listed 2026-06-20 03:20:04 BST Last listed 2026-06-20 03:20:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 04:16:04 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
64.62.197.138	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 03:59 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-07 11:26:58 BST Last observed 2026-06-20 03:59:42 BST First listed 2026-06-20 03:05:04 BST Last listed 2026-06-20 03:05:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 03:59:42 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
45.33.95.64	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 59	20 Jun 03:58 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 59 First observed 2026-06-20 03:58:23 BST Last observed 2026-06-20 03:58:23 BST First listed 2026-06-20 03:00:06 BST Last listed 2026-06-20 03:00:06 BST Last delisted — Last expired — Evidence expiry 2026-07-20 03:58:23 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
45.156.128.7	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 03:42 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 03:42:35 BST Last observed 2026-06-20 03:42:35 BST First listed 2026-06-20 02:45:09 BST Last listed 2026-06-20 02:45:09 BST Last delisted — Last expired — Evidence expiry 2026-07-20 03:42:35 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
64.62.197.167	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 03:41 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-03-25 09:35:20 GMT Last observed 2026-06-20 03:41:48 BST First listed 2026-06-20 02:45:07 BST Last listed 2026-06-20 02:45:07 BST Last delisted — Last expired — Evidence expiry 2026-07-20 03:41:48 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
64.62.197.170	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1	20 Jun 03:40 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 First observed 2026-06-20 03:40:35 BST Last observed 2026-06-20 03:40:35 BST First listed 2026-06-20 02:45:04 BST Last listed 2026-06-20 02:45:04 BST Last delisted — Last expired — Evidence expiry 2026-07-20 03:40:35 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed
20.118.240.192	LISTED	127.0.0.4	Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 17	20 Jun 03:38 BST	threatmail	1 / 0
Full evidence / reason Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 17 First observed 2026-06-20 03:38:13 BST Last observed 2026-06-20 03:38:13 BST First listed 2026-06-20 02:40:05 BST Last listed 2026-06-20 02:40:05 BST Last delisted — Last expired — Evidence expiry 2026-07-20 03:38:13 BST Confidence 85/100 high Sources threatmail Return code 127.0.0.4 Lists / Delists 1 / 0 Sanitised history JSON feed

Lists / Delists shows list_count and delist_count. OBSERVED means the IP exists in history but is not currently in BIND and has no recorded delist event. Trusted addresses in /etc/scotnet/dnsbl-public-hide.txt are omitted from this public history table.