Threat LevelCRITICAL72/1002 rule types across 2 attack categories

14 incidents · 2 rule types · active attacker + blocklisted · persistent 14-day campaign · last seen 10d ago

PTR	N/A
Org / ASN	IP Kiktev Nikolay Vladimirovich
Country	🇳🇱 The Netherlands
City	Amsterdam, North Holland
Timezone	Europe/Amsterdam

Attack Analysis

🇳🇱 Netherlands · Rotterdam · 211736 · TOV E-RISHENNYA

IDS: Blocklist — Spamhaus DROP

This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.

Webshell Upload Scan

This IP rapidly probed multiple non-existent PHP paths in under 60 seconds — a hallmark of automated webshell scanning tools hunting for previously uploaded backdoors or vulnerable file-upload endpoints. If successful, a webshell grants the attacker full remote code execution on the server.

Reports (14)

Date	Severity	Description
22 Jul 2026 - 04:33	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
21 Jul 2026 - 13:20	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
13 Jul 2026 - 04:23	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
12 Jul 2026 - 23:16	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
11 Jul 2026 - 08:43	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
11 Jul 2026 - 06:50	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
11 Jul 2026 - 00:18	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
10 Jul 2026 - 17:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
10 Jul 2026 - 08:43	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
10 Jul 2026 - 08:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
9 Jul 2026 - 02:12	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
9 Jul 2026 - 02:04	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37
7 Jul 2026 - 23:32	high	Web: Webshell scan — 3+ unknown PHP probes in 60s
7 Jul 2026 - 23:28	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 37

Report for IP: 185.156.73.218

Attack Analysis

Reports (14)

Related IPs — Same /24 Block (185.156.73.0/24)