Transparency

BIND is the source of truth for live listings • meta.json records observation and delisting history

Transparency snapshot

Back to DNSBL
Active listings
2,634
Live from BIND zone (A + AAAA)
Threat activity (7 days)
40
Unique suspicious public IPs • 1,853 matched events • 4,593 requests evaluated
Repeat offenders
119
Threatmail: 70 • Apache security: 49
Lifecycle
Active
Pending review: 0 • Expiring ≤7d: 31 • Expired last run: 0
Delisted records
4
1 in the last 7 days • unique IPs with a recorded delist
Mail feeds
Active
Threatmail: active
User reports: not enabled • last 2026-06-24 13:15 BST
History coverage
69.9%
1,841 of 2,634 live listings have metadata
Last zone update
2026-06-24 13:05 BST
Authoritative BIND zone last modified
Live status, return code and TXT reason are reconciled directly against the BIND zone. An address is marked DELISTED only when a real delist timestamp, counter or audit event exists; otherwise a non-live historical address is OBSERVED. Repeat-offender totals are grouped by the latest sanitised attack source; complete event history is available only through the per-IP JSON feed and delist information. Apache activity cache updated 2026-06-24 13:15 BST.
BIND records: IPv4 A = 2,634 • IPv6 AAAA = 0 • TXT = 2,634 • SOA serial 2026062419.

Listings history

Live BIND entries plus observation and delisting history. Times use UK local GMT/BST.

Clear

Showing 401–500 of 2,805 matching records.

IP Status Code Reason Last activity Sources Lists / Delists Details
66.132.186.221 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
40.67.161.44 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 3 / 0
66.132.172.177 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
3.87.27.156 LISTED 127.0.0.8 Apache security: path_traversal apache-security 23 / 0
207.241.173.215 LISTED 127.0.0.4 Threat Prevention: Successful Credential Theft Detected / ET WEB_SPECIFIC_APPS Wordpress LiteSpeed Cache Plugin debug.log Access Attempt (CVE-2024-44000) threatmail 1 / 0
3.142.170.60 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 15 / 0
74.235.100.195 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 115 threatmail 1 / 0
198.235.24.244 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
195.3.220.7 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 18 / 0
20.65.193.105 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 33 threatmail 1 / 0
37.120.213.13 LISTED 127.0.0.4 Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt apache-security threatmail 2 / 0
217.181.88.165 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 1 / 0
217.181.81.89 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 1 / 0
20.83.32.170 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 30 threatmail 1 / 0
69.5.169.41 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
91.230.121.134 LISTED 127.0.0.8 Apache security: framework_exploit_probe apache-security 9 / 0
20.251.117.149 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 4 / 0
216.180.246.140 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 287 threatmail 1 / 0
85.204.70.106 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 1 / 0
69.5.169.63 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 127 threatmail 2 / 0
199.45.154.158 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
74.248.112.30 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 9 / 0
23.251.34.171 LISTED 127.0.0.4 Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt threatmail 1 / 0
221.159.119.6 LISTED 127.0.0.4 Apache security: framework_exploit_probe apache-security 2 / 0
193.163.125.247 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0
193.163.125.70 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0
180.244.187.139 LISTED 127.0.0.4 Apache security: device_api_probe apache-security 1 / 0
45.156.128.5 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
20.40.216.95 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 25 threatmail 1 / 0
4.232.80.255 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 8 / 0
185.194.205.18 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 2 / 0
47.88.7.35 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 88 threatmail 1 / 0
198.235.24.183 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
66.132.186.176 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
69.5.169.127 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
80.94.95.211 LISTED 127.0.0.8 Apache security: repeated explicit application probes apache-security 7 / 0
198.235.24.124 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
205.210.31.168 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0
64.62.197.55 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
167.94.145.28 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
45.43.58.131 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 59 threatmail 1 / 0
20.104.244.165 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 5 / 0
205.210.31.64 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
212.127.91.32 LISTED 127.0.0.4 Apache security: command_injection_probe apache-security 1 / 0
172.237.117.50 LISTED 127.0.0.4 Threat Prevention: Attempted Information Leak / ET SCAN MS Terminal Server Traffic on Non-standard Port threatmail 1 / 0
172.239.117.185 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 1 / 0
216.25.89.101 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 288 threatmail 1 / 0
193.163.125.169 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0
198.235.24.66 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 3 / 0
20.206.64.115 LISTED 127.0.0.4 Apache security: distinct 4xx path scan apache-security 2 / 0
202.183.141.133 LISTED 127.0.0.4 Apache security: path_traversal apache-security 1 / 0
20.151.116.187 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 3 / 0
66.132.172.204 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
66.132.172.131 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
20.226.45.125 LISTED 127.0.0.4 Apache security: distinct 4xx path scan apache-security 3 / 0
176.65.139.140 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d apache-security threatmail 13 / 0
45.148.10.200 LISTED 127.0.0.8 Apache security: repeated explicit application probes apache-security 6 / 0
110.35.80.116 LISTED 127.0.0.4 Threat Prevention: Web Application Attack / ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt apache-security threatmail 4 / 0
20.104.203.253 LISTED 127.0.0.8 Apache security: distinct 4xx path scan apache-security 4 / 0
198.11.178.150 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d apache-security threatmail 4 / 0
185.180.141.68 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 251 threatmail 1 / 0
185.180.141.67 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 251 threatmail 1 / 0
212.132.119.238 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 1 / 0
160.250.51.11 LISTED 127.0.0.4 Threat Prevention: Attempted Information Leak / ET EXPLOIT Netgear DGN Remote Command Execution threatmail 1 / 0
64.62.197.138 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
45.33.95.64 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 59 threatmail 1 / 0
45.156.128.7 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
64.62.197.167 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
64.62.197.170 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
20.118.240.192 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 17 threatmail 1 / 0
138.197.174.121 LISTED 127.0.0.4 Apache security: repeated explicit application probes apache-security 2 / 0
64.62.197.22 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0
86.54.31.34 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 123 threatmail 1 / 0
135.233.112.26 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 176 threatmail 1 / 0
45.63.4.69 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 7 / 0
176.65.139.239 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 3 / 0
194.48.251.50 LISTED 127.0.0.4 Apache security: device_api_probe apache-security 2 / 0
52.242.128.238 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 7 / 0
195.178.110.103 LISTED 127.0.0.4 Apache security: path_traversal apache-security 1 / 0
135.119.112.180 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 175 threatmail 1 / 0
45.205.1.245 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 12 / 0
195.178.110.223 LISTED 127.0.0.8 Apache security: framework_exploit_probe apache-security 4 / 0
93.123.109.103 LISTED 127.0.0.4 Apache security: command_injection_probe apache-security 2 / 0
65.52.75.227 LISTED 127.0.0.8 Apache security: distinct 4xx path scan apache-security 7 / 0
35.216.195.77 LISTED 127.0.0.4 Apache security: framework_exploit_probe apache-security 1 / 0
40.124.174.187 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 50 threatmail 2 / 0
195.178.110.155 LISTED 127.0.0.4 Apache security: path_traversal apache-security 1 / 0
167.94.145.17 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 1 / 0
94.74.71.163 LISTED 127.0.0.8 Apache security: repeated explicit application probes apache-security 2 / 0
147.185.132.168 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0
34.228.104.231 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 11 / 0
71.6.134.236 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 3 / 0
203.55.131.3 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 3 / 0
125.45.66.120 LISTED 127.0.0.4 Apache security: device_api_probe apache-security 1 / 0
52.138.0.210 LISTED 127.0.0.4 Apache security: distinct 4xx path scan apache-security 1 / 0
20.12.213.50 LISTED 127.0.0.8 Apache security: shell_backdoor_probe apache-security 5 / 0
100.29.192.13 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET CINS Active Threat Intelligence Poor Reputation IP group 135 threatmail 1 / 0
52.20.198.190 LISTED 127.0.0.8 Repeat offender: 3 unique events/7d, 3/30d threatmail 22 / 0
45.159.230.92 LISTED 127.0.0.8 Apache security: repeated explicit application probes apache-security 3 / 0
198.235.24.221 LISTED 127.0.0.4 Threat Prevention: Misc Attack / ET DROP Dshield Block Listed Source group 1 threatmail 2 / 0

Lists / Delists shows list_count and delist_count. OBSERVED means the IP exists in history but is not currently in BIND and has no recorded delist event. Trusted addresses in /etc/scotnet/dnsbl-public-hide.txt are omitted from this public history table.