JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:470:1:332::157

2001:470:1:332::157 was found in our database!

This IP was reported 2,906 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	The Shadowserver Foundation, Inc.
Usage Type	Fixed Line ISP
ASN	AS6939
Hostname(s)	scan-49p.shadowserver.io
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	Pleasanton, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2001:470:1:332::157

Whois 2001:470:1:332::157

IP Abuse Reports for 2001:470:1:332::157:

This IP address has been reported a total of 2,906 times from 194 distinct sources. 2001:470:1:332::157 was first reported on June 18th 2022, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 cazae	2026-08-24 08:51:52 (17 hours ago)	Unauthorized attempt on debian [17689/tcp] Source port: 40276 TTL: null Packet length: 60 TOS: null ... show more Unauthorized attempt on debian [17689/tcp] Source port: 40276 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇪🇸 yvoictra	2026-08-24 08:09:45 (18 hours ago)	2026-08-24T10:09:45.337034+02:00 apollo sshd-session[3787739]: Invalid user from 2001:470:1:332::15 ... show more 2026-08-24T10:09:45.337034+02:00 apollo sshd-session[3787739]: Invalid user from 2001:470:1:332::157 port 7994 ... show less	Brute-Force SSH
🇩🇪 VentryShield	2026-08-24 07:22:30 (18 hours ago)	p0t honeypot: unknown connection on port 8080/tcp, 186 bytes received from client	Port Scan
🇺🇸 chronos	2026-08-24 06:30:53 (19 hours ago)	[AUTORAVALT][[24/08/2026 - 03:30:53 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332 ... show more [AUTORAVALT][[24/08/2026 - 03:30:53 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::157][scan-49p.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. B] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇭🇺 kranem	2026-08-23 09:00:24 (1 day ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-08-23T07:57:19Z User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 show less	Bad Web Bot
🇩🇪 VentryShield	2026-08-23 02:51:42 (1 day ago)	p0t honeypot: unknown connection on port 84/tcp, 217 bytes received from client	Port Scan
🇦🇹 centurion	2026-08-23 01:18:27 (2 days ago)	Unauthorized attempt on cendev [444/tcp] Source port: 45878 TTL: null Packet length: 60 TOS: null ht ... show more Unauthorized attempt on cendev [444/tcp] Source port: 45878 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 chronos	2026-08-21 01:13:41 (4 days ago)	[AUTORAVALT][[20/08/2026 - 22:13:40 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332 ... show more [AUTORAVALT][[20/08/2026 - 22:13:40 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::157][scan-49p.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. B] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇫🇮 as211431.net	2026-08-19 07:03:33 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇮🇹 yvoictra	2026-08-18 08:23:16 (6 days ago)	2026-08-18T10:23:15.633558+02:00 lamvda sshd-session[2910713]: Invalid user from 2001:470:1:332::15 ... show more 2026-08-18T10:23:15.633558+02:00 lamvda sshd-session[2910713]: Invalid user from 2001:470:1:332::157 port 44582 ... show less	Brute-Force SSH
🇺🇸 chronos	2026-08-17 06:28:39 (1 week ago)	[AUTORAVALT][[17/08/2026 - 03:28:39 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332 ... show more [AUTORAVALT][[17/08/2026 - 03:28:39 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::157][scan-49p.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. B] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇭🇺 kranem	2026-08-16 09:00:21 (1 week ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-08-16T07:00:16Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 show less	Bad Web Bot
🇭🇺 kranem	2026-08-16 03:00:13 (1 week ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-08-16T02:15:30Z User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 show less	Bad Web Bot
🇩🇪 VentryShield	2026-08-15 05:37:36 (1 week ago)	p0t honeypot: unknown connection on port 8443/tcp, 128 bytes received from client	Port Scan
🇦🇹 centurion	2026-08-15 02:50:02 (1 week ago)	Unauthorized attempt on cendev [8081/tcp] Source port: 37165 TTL: null Packet length: 60 TOS: null h ... show more Unauthorized attempt on cendev [8081/tcp] Source port: 37165 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 2906 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 185.191.171.5

🇺🇸 165.154.135.211

🇭🇰 156.225.1.38

🇺🇸 147.182.231.59

🇺🇸 107.150.98.86

🇺🇸 107.150.97.231

🇨🇳 59.36.78.66

🇺🇸 20.84.77.130

🇯🇵 204.93.235.41

🇧🇬 193.24.211.204

🇬🇧 188.240.59.24

🇱🇹 185.170.253.248

🇨🇳 182.88.166.20

🇮🇩 165.154.151.207

🇺🇸 162.216.150.21

🇺🇸 136.64.215.100

🇨🇳 117.61.14.168

🇺🇸 96.9.207.104

🇫🇷 91.231.89.213

🇫🇷 91.231.89.77