Is 185.220.100.240 Safe? IP Analysis Report

Suspicious Data Center/Web Hosting/Transit
Germany DE · Haßfurt, Bavaria · F3 Netze e.V.
Known Threat High Abuse Score PTR Found
0 Risk Score

Suspicious

Abuse Score 100% AbuseIPDB
Reports 924 total
Reporters 0 users
Threat Feeds ?Number of threat intelligence databases (TOR, botnets, malware, phishing) in which this IP was found. 1 matched
Domains 0 associated
Share: Twitter Facebook LinkedIn
JSON CSV
Is this IP safe?
Key Findings
Overall Verdict
This IP address shows suspicious signals.
AbuseIPDB: 100% abuse confidence
924 reports from 0 users
Threat Intelligence
Known threat — 1 feed
Analysis Sources
AbuseIPDB ?Community-driven IP abuse reporting platform with confidence scoring. Flagged
Confidence score: 100%
Threat Feeds ?Threat intelligence databases (TOR, botnets, malware, phishing) queried for this IP. Detected
1 matches
Geolocation Found
Germany · Haßfurt
Reverse DNS Found
tor-exit-13.zbau.f3netze.de
Summary
Verdict: Suspicious
Germany (Haßfurt)
F3 Netze e.V.
AbuseIPDB: 100%
Known threat (1 feeds)
Analyze Another IP
Geolocation Information
Country Germany DE
City Haßfurt, Bavaria
ISP F3 Netze e.V.
Organization F3 Netze e.V
ASN AS205100 F3 Netze e.V.
Network Details
ISP

F3 Netze e.V.

Organization

F3 Netze e.V

ASN

AS205100 F3 Netze e.V.

AbuseIPDB Report
100%
Abuse Score
924
Reports
0
Reporters
Data Center/Web Hosting/Transit
Assessment
Bad Reputation
This IP has been widely reported for abuse.
Threat Intelligence 1 feed
TOR Exit Nodes ?IP addresses of known TOR network exit nodes. TOR is used for anonymous browsing but also for malicious activities. tor
Detected in TOR Exit Nodes feed
Reverse DNS (PTR)
tor-exit-13.zbau.f3netze.de

What is 185.220.100.240?

185.220.100.240 is an IP address that was analyzed by ScamSandbox. Based on our automated analysis, this IP address exhibits suspicious characteristics commonly associated with malicious activity.

The IP address 185.220.100.240 is located in Haßfurt, Germany and is operated by F3 Netze e.V. (AS205100 F3 Netze e.V.). The associated organization is F3 Netze e.V.

The reverse DNS (PTR) lookup for this IP address resolves to tor-exit-13.zbau.f3netze.de, which provides additional context about the infrastructure this IP belongs to.

According to the AbuseIPDB database, this IP address has an abuse confidence score of 100% with 924 abuse reports. A confidence score above 50% indicates that this IP has been significantly reported for abusive activities, including spam, port scanning, brute force attacks, or other malicious behavior.

This IP address has been identified as a known threat in our threat intelligence databases. It appears in 1 threat intelligence feed. The identified threat categories include: TOR Exit Nodes .

The overall risk score assigned to 185.220.100.240 by ScamSandbox is 40/100 (where 100 is the highest risk). This score is calculated by weighing signals from AbuseIPDB, threat intelligence feeds, geolocation data, reverse DNS, and community reports.

Security Provider Verdicts for 185.220.100.240

The table below shows the verdict from each security source checked during this analysis. A Flagged result means the source detected malicious or abusive activity. Clean means no threat was detected.

AbuseIPDB ?Community-driven IP abuse reporting platform with confidence scoring. Users worldwide report malicious IPs. IP address abuse reports database
Flagged (100%)
Threat Intelligence ?Aggregation of multiple threat databases (Emerging Threats, SANS DShield, Abuse.ch Feodo/URLhaus/SSL, PhishTank) to detect malicious IPs. Multi-source intelligence feeds (TOR, botnets, malware)
Threat Detected (1 feed)
TOR Exit Node ?IP addresses of known TOR network exit nodes. TOR is used for anonymous browsing but also for malicious activities. TOR anonymization network check
TOR Node Confirmed
Reverse DNS ?The PTR record maps an IP address to a domain name. Its absence may indicate a temporary or suspicious IP. PTR record and associated hostname
tor-exit-13.zbau.f3netze.de
ScamSandbox Overall Assessment
Suspicious (40/100)

What to do about 185.220.100.240?

If you have observed traffic from this IP address or it has attempted to connect to your systems, here are the recommended actions:

  1. Do not interact with this IP address — do not respond to suspicious requests or click on associated links.
  2. Block the IP in your firewall — add 185.220.100.240 to your blocklist (iptables, UFW, Windows Firewall, or your network firewall).
  3. Report the IP — submit a report on AbuseIPDB to help the community.
  4. Check your logs — review your server/firewall logs to identify any suspicious activity from this IP.
  5. Contact the hosting provider — if malicious activity persists, contact the ISP or hosting provider (F3 Netze e.V.) to report the abuse.

Frequently Asked Questions about 185.220.100.240

Based on our analysis, 185.220.100.240 is not considered safe. The IP address has been flagged as suspicious with a risk score of 40/100 and is identified as a known threat in our intelligence feeds. We recommend blocking this IP.

The IP address 185.220.100.240 is managed by F3 Netze e.V. (organization: F3 Netze e.V) , with autonomous system number AS205100 F3 Netze e.V.. It is located in Haßfurt, Germany. The ISP is responsible for the IP address block that includes 185.220.100.240, but the end user controlling the server may be a customer of this ISP.

Yes, 185.220.100.240 is identified as a TOR exit node. TOR exit nodes are the final relays in the TOR network — traffic passing through TOR appears to originate from the exit node's IP address. This means malicious traffic observed from this IP could come from any TOR user worldwide, not necessarily from the node operator. However, TOR exit nodes are often used for anonymization activities that may include scanning, brute force, or spam. It is recommended to block TOR exit nodes if your service does not need to be accessible via TOR.

Yes, 185.220.100.240 is a known threat. This IP address appears in 1 threat intelligence feed. The identified threat categories include: TOR Exit Nodes. This means this IP has been associated with malicious activities such as port scanning, brute force attacks, malware distribution, botnet exploitation, or denial of service attacks. It is strongly recommended to block this IP address and report any suspicious activity.

Community Reports

No community reports yet for 185.220.100.240. Be the first to share your experience.