216.73.216.155 is listed on the Spamhaus XBL

Why was this IP listed?

A device using 216.73.216.155 is infected with malware:

216.73.216.155 initiated a connection to a ranbyus command and control server, with contents unique to ranbyus C&C command protocols.

Technical details of the ranbyus detection

216.73.216.155 initiated a tcp connection from 216.73.216.155 using source port 55037, to the sinkhole IP address 216.218.185.162 on destination port 80.

The most recent detection was on: March 22 2026, 10:02:22 UTC.

What should be done about it?

If this is a shared server, please call your hosting company or ISP!

These listings are the result of what we believe to be a security issue. To stop ongoing listings and to secure your network, devices, and data, we recommend both prevention and remediation of the issue.

Prevention

For home networks & end users:

Apps or software should be always be downloaded and updated from official pages or platforms, such as Google Play and the Apple Store.

• Update operating systems and software on all computers and devices
• Update your anti-virus/anti-malware programs, and run full scans on every device that is available
• Change all passwords - routers, computers, laptops, phones, mobiles, etc and reboot them afterward
  • Use two-factor authentication when possible!
• Any smart devices that are not in use should be disconnected from the network immediately.

For business/office/enterprise environments:

• Update operating systems and software on all computers and devices
• Update your anti-virus/anti-malware programs, and run full scans on every device that is available
• Verify router and firewall configurations and ensure the firmware is the most recent version
  • Disable any unecessary external access to your router & network, and appropriately secure any necessary external access procedures
• Change all passwords - routers, computers, laptops, servers, CMS, FTP, administrative, domain, email, etc
  • Use two-factor authentication when possible!
• Monitoring and reviewing network traffic for unusual patterns or destination ports can be very useful
  • Consider investing in an host-based IDS or an enterprise anti-malware solution, and update it frequently.

Remediation

The device(s) or computer(s) that caused this issue should be found and secured. The following information should address most cases, but please seek professional assistance if it is necessary:

• Update your anti-virus/anti-malware programs, and run full scans on every device that is available
• Programs like Windows Defender, Windows Malicious Software Removal Tool (MSRT), Malwarebytes, Norton Power Eraser, CCleaner and/or McAfee Stinger can help. There is also a version of Malwarebytes for Mac/OSX. These tools are free of charge!
• If you have a CMS or website, ensure it is up to date. All plug-ins, extensions & patches for it should be updated and regularly maintained
• We can only see what's coming from the NAT (public) IP; anything inside your network is visible only to you. Packet capture is a good way to identify which devices are generating unusual traffic
• Calling your ISP or taking your device to a professional tech support service can be helpful.

Spamhaus has a "hacked or compromised devices" FAQ with tips and links to help in this situation.

XBL listings expire automatically after the last detection. If necessary, once the security issue is solved, you can update an existing ticket to request removal.

Removal from XBL

XBL listings expire automatically some time after the last detection. If necessary, once the security issue is solved, you can request removal.