JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.254.12.40

170.254.12.40 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 39%: ?

39%

ISP	NET PARAISO
Usage Type	Fixed Line ISP
ASN	AS265094
Domain Name	netparaiso.com
Country	🇧🇷 Brazil
City	Santa Lucia, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.254.12.40

Whois 170.254.12.40

IP Abuse Reports for 170.254.12.40:

This IP address has been reported a total of 8 times from 7 distinct sources. 170.254.12.40 was first reported on August 15th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 iNetWorker	2026-09-16 19:31:26 (6 hours ago)	firewall-block, port(s): 60638/udp	Port Scan
Anonymous	2026-09-09 08:01:03 (1 week ago)	denied traffic to a non-approved destination port. destination port 23540.	Port Scan
🇸🇪 NordhTech	2026-09-07 09:45:18 (1 week ago)	Multiple malicious connection attempts detected, trying port(s) 43529/udp, then blocked by firewall.	Port Scan Hacking
🇬🇪 ORDUNET	2026-09-03 20:32:47 (1 week ago)	Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:27004/udp in AS203136 (LLC Ord ... show more Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:27004/udp in AS203136 (LLC Ordunet), Georgia. This source sustained more than 150 packets/sec toward that single UDP port and was one of 3229 distinct sources from 1488 autonomous systems in 139 countries taking part in a coordinated flood on 2026-09-03/04. Our border router discarded 184 million packets (149 GB) of this attack traffic in 24 hours. Detected on a MikroTik RouterOS router by per-source rate accounting in the raw/prerouting chain (dst-limit 150,50,src-address/10s); the timestamp is the moment this source crossed the threshold, timezone +04:00. This is not a port scan and not a brute-force attempt - it is a packet flood, so the host is almost certainly compromised and part of a botnet. Full packet-level evidence available on request to [email protected]. show less	DDoS Attack Exploited Host
🇺🇸 gui-ying233	2026-08-31 08:09:42 (2 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-27 03:34:23 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-08-24 02:29:08 (3 weeks ago)	denied traffic to a non-approved destination port. destination port 59204.	Port Scan
🇫🇷 Zkillu	2026-08-15 17:55:00 (1 month ago)	UDP flood attack on 31.56.58.23 UDP:80 and UDP:9100 (2026-08-15 17:53-17:57 UTC). Peak aggregate 32 ... show more UDP flood attack on 31.56.58.23 UDP:80 and UDP:9100 (2026-08-15 17:53-17:57 UTC). Peak aggregate 32 Gbps / 1.95 Mpps against victim AS215599 - RTBH mitigation triggered. This IP (AS265094) sent ~7608 packets (8.67 MB) during the attack window. Likely a compromised device (Mirai-like botnet). show less	DDoS Attack Exploited Host

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.30

🇦🇷 191.81.54.136

🇨🇦 178.128.236.113

🇺🇸 147.185.132.19

🇻🇳 113.179.75.32

🇺🇸 52.248.42.156

🇳🇱 45.148.10.183

🇪🇸 5.183.103.172

🇰🇷 218.149.228.177

🇮🇹 217.26.178.12

🇺🇸 205.210.31.102

🇧🇷 191.241.73.127

🇦🇷 190.50.66.193

🇷🇺 188.16.115.101

🇵🇹 149.90.59.231

🇦🇱 141.98.143.26

🇨🇳 106.75.166.174

🇮🇳 103.216.69.40

🇨🇳 101.34.249.202

🇺🇸 66.249.84.34