Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-10T13:37:03.139663+02:00 mail postfix/submission/smtpd[1760641]: lost connection after EHLO from unknown[84.200.193.140]
2026-10-10T13:37:03.139749+02:00 mail postfix/submission/smtpd[1760641]: disconnect from unknown[84.200.193.140] ehlo=1 a ...
show more2026-10-10T13:37:03.139663+02:00 mail postfix/submission/smtpd[1760641]: lost connection after EHLO from unknown[84.200.193.140]
2026-10-10T13:37:03.139749+02:00 mail postfix/submission/smtpd[1760641]: disconnect from unknown[84.200.193.140] ehlo=1 auth=0/1 commands=1/2
2026-10-10T13:37:03.241044+02:00 mail postfix/submission/smtpd[1760641]: lost connection after EHLO from unknown[84.200.193.140]
...
show less
[RoutePulse | 2026-09-19T05:04:06Z | RTBH-INJECTED]
ATTACK CLASS: exchange_bruteforce
SOURCE: 84.200.193.140 · AS214036 Ultahost, Inc. · Germany
EVIDENCE: Mail-transport credential probing on exchange.goline.ch — 6 sessions all the same size (spread ...
show more[RoutePulse | 2026-09-19T05:04:06Z | RTBH-INJECTED]
ATTACK CLASS: exchange_bruteforce
SOURCE: 84.200.193.140 · AS214036 Ultahost, Inc. · Germany
EVIDENCE: Mail-transport credential probing on exchange.goline.ch — 6 sessions all the same size (spread 1.01x) in 60min via SMTP submission (FortiAnalyzer perimeter log: the balancer SNATs these protocols, so this is the only source of the real clie
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Web App Attack
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown