Report for IP: 94.154.43.251

Threat LevelCRITICAL78/1003 rule types across 2 attack categories
9 incidents on record · 3 rule types · active attacker + blocklisted · persistent 12-day campaign · seen 6h ago
PTR N/A
Org / ASN FOP Danik Vyacheslav Evgenievich
Country 🇳🇱 The Netherlands
City Amsterdam, North Holland
Timezone Europe/Amsterdam

Attack Analysis

IDS: Blocklist — Spamhaus DROP
This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.
Suricata IDS Alert
Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.
IDS: Blocklist — Dshield
This IP was reported to the DShield community blocklist by multiple independent security sensors worldwide. DShield aggregates firewall logs from thousands of contributors; IPs on this list are confirmed active attackers observed across many networks.

Reports (9)

Date Severity Description
29 Sep 2026 - 18:49 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 17
29 Sep 2026 - 18:49 high IDS: Blocklist — Dshield listed IP — ET DROP Dshield Block Listed Source group 1
28 Sep 2026 - 18:33 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 17
28 Sep 2026 - 06:01 medium IDS: Suricata alert — GPL RPC xdmcp info query
28 Sep 2026 - 06:01 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 17
28 Sep 2026 - 05:56 high IDS: Suricata alert — GPL RPC xdmcp info query
28 Sep 2026 - 01:54 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 17
27 Sep 2026 - 18:43 high IDS: Blocklist — Spamhaus DROP listed IP
17 Sep 2026 - 17:06 high IDS: Blocklist — Spamhaus DROP listed IP