JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2001:470:1:332::28

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

100% Critical

3,100 reports

210 reporters · latest 3 hours ago

ISP: The Shadowserver Foundation, Inc.
Usage Type: Fixed Line ISP
ASN: AS6939
Domain Name: shadowserver.org
Country: 🇺🇸 United States of America
City: Pleasanton, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

3,100 from 210 distinct reporters

First reported

June 18th 2022

Most recent report

3 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 33 🇺🇸 United States of America 24 🇫🇮 Finland 16

Most common categories Brute-Force 48 Port Scan 45 Bad Web Bot 22 SSH 20 Hacking 17

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 kranem	2026-10-02 09:00:04 UTC · (1 month ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-02T08:22:33Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefo ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-02T08:22:33Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0 show less	Bad Web Bot
Anonymous	2026-10-02 08:26:49 UTC · (1 month ago)	Blocked by UFW [995/tcp] \| SPT: 49935 \| TTL: null \| LEN: 60 \| TOS: null • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇫🇮 kumiko	2026-10-02 08:15:02 UTC · (1 month ago)	[2026-10-02 11:15:02] Unauthorized port scan/probing (3 times on port 2087) Blocked by UFW	Port Scan
🇹🇭 Sawasdee	2026-10-02 08:03:10 UTC · (1 month ago)	Port Scan/VNC login attempt ...	Port Scan
🇩🇪 marcel-knorr.de	2026-10-02 05:44:56 UTC · (1 month ago)	[MK-VM3] Blocked by UFW	Brute-Force Port Scan
Anonymous	2026-10-02 01:41:25 UTC · (1 month ago)	Fail2Ban triggered	Web App Attack
🇬🇧 chrisw	2026-10-01 08:32:53 UTC · (1 month ago)	Oct 1 09:32:52 l03 sshd[24803]: Invalid user from 2001:470:1:332::28 port 61462 ...	SSH
🇩🇪 DSK	2026-10-01 06:49:28 UTC · (1 month ago)	Unauthorized connection Drop [9000/tcp] #14645	Bad Web Bot
🇫🇮 kumiko	2026-10-01 05:01:00 UTC · (1 month ago)	[2026-10-01 08:00:59] Unauthorized port scan/probing (3 times on port 8001) Blocked by UFW	Port Scan
🇫🇮 kumiko	2026-10-01 04:09:49 UTC · (1 month ago)	[2026-10-01 07:09:48] Unauthorized port scan/probing (3 times on port 5001) Blocked by UFW	Port Scan
🇫🇮 kumiko	2026-10-01 02:24:42 UTC · (1 month ago)	[2026-10-01 05:24:42] Unauthorized port scan/probing (3 times on port 2031) Blocked by UFW	Port Scan
🇧🇪 sid3windr	2026-09-30 08:57:04 UTC · (1 month ago)	SSH port scan (Tarpitted for 20s, wasted 31B)	Port Scan SSH
Anonymous	2026-09-30 05:07:12 UTC · (1 month ago)	Fail2Ban triggered	Web App Attack
🇩🇪 gnb	2026-09-30 04:06:58 UTC · (1 month ago)	2026-09-30T06:06:56.231325+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=515273 PROTO=TCP SPT=19846 DPT=8010 WINDOW=43200 RES=0x00 SYN URGP=0 20 ... show more 2026-09-30T06:06:56.231325+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=515273 PROTO=TCP SPT=19846 DPT=8010 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T06:06:57.270413+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=1000372 PROTO=TCP SPT=19846 DPT=8010 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T06:06:58.294307+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=70522 PROTO=TCP SPT=19846 DPT=8010 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 gnb	2026-09-30 03:12:12 UTC · (1 month ago)	2026-09-30T05:12:09.305232+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=144610 PROTO=TCP SPT=65370 DPT=6443 WINDOW=43200 RES=0x00 SYN URGP=0 20 ... show more 2026-09-30T05:12:09.305232+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=144610 PROTO=TCP SPT=65370 DPT=6443 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T05:12:10.369218+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=541373 PROTO=TCP SPT=65370 DPT=6443 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T05:12:11.384578+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0332:0000:0000:0000:0028 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=25380 PROTO=TCP SPT=65370 DPT=6443 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan

Showing 61 to 75 of 3100 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇷 189.37.78.37

🇨🇭 179.43.153.18

🇺🇸 170.106.35.137

🇺🇸 13.222.160.180

🇩🇪 213.209.159.241

🇻🇳 210.245.30.140

🇬🇧 193.163.125.198

🇳🇱 192.253.248.222

🇨🇳 175.30.48.3

🇺🇸 167.253.17.95

🇺🇸 162.216.150.7

🇩🇪 162.62.126.84

🇮🇳 136.232.11.10

🇧🇩 116.206.253.50

🇺🇸 95.155.139.173

🇺🇸 31.134.11.182

🇺🇸 13.221.74.110

🇳🇱 195.178.110.217

🇨🇳 183.36.35.204

🇧🇷 177.171.28.195