JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2001:470:1:332::5

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

100% Critical

2,544 reports

225 reporters · latest 2 days ago

ISP: The Shadowserver Foundation, Inc.
Usage Type: Fixed Line ISP
ASN: AS6939
Domain Name: shadowserver.org
Country: 🇺🇸 United States of America
City: Pleasanton, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

2,544 from 225 distinct reporters

First reported

October 25th 2021

Most recent report

2 days ago

Last 60 days

Top reporter locations 🇩🇪 Germany 42 🇺🇸 United States of America 38 🇫🇮 Finland 14

Most common categories Brute-Force 60 Port Scan 52 Hacking 30 SSH 23 Web App Attack 22

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 chronos	2026-10-23 16:20:08 UTC · (1 week ago)	[AUTORAVALT][[23/10/2026 - 13:20:08 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::5][scan-39af.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, ... show more [AUTORAVALT][[23/10/2026 - 13:20:08 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::5][scan-39af.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Br] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 MatCat	2026-10-22 02:05:11 UTC · (2 weeks ago)	Banned by fail2ban: sshd	Brute-Force SSH
🇹🇭 Sawasdee	2026-10-21 02:00:13 UTC · (2 weeks ago)	Port Scan/VNC login attempt ...	Port Scan
🇧🇪 sid3windr	2026-10-21 00:51:50 UTC · (2 weeks ago)	SSH port scan (Tarpitted for 20s, wasted 10B)	Port Scan SSH
🇹🇷 neron	2026-10-20 22:47:53 UTC · (2 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇫🇮 as211431.net	2026-10-20 02:02:29 UTC · (2 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108 ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇹🇷 neron	2026-10-19 22:00:07 UTC · (2 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇷🇴 sh97	2026-10-19 07:54:02 UTC · (2 weeks ago)	2026-10-19T07:53:59.233116+00:00 ro1-hostc-storage sshd[3962298]: Invalid user from 2001:470:1:332::5 port 4490 2026-10-19T07:54:01.008094+00:00 ro1-hostc-storage sshd[3962299]: Invalid user from 2001:470:1:332::5 port 4488 2026-10-19T07:54:01.3801 ... show more 2026-10-19T07:53:59.233116+00:00 ro1-hostc-storage sshd[3962298]: Invalid user from 2001:470:1:332::5 port 4490 2026-10-19T07:54:01.008094+00:00 ro1-hostc-storage sshd[3962299]: Invalid user from 2001:470:1:332::5 port 4488 2026-10-19T07:54:01.380102+00:00 ro1-hostc-storage sshd[3962838]: Invalid user from 2001:470:1:332::5 port 4498 ... show less	Brute-Force SSH
🇺🇸 chronos	2026-10-19 06:29:16 UTC · (2 weeks ago)	[AUTORAVALT][[19/10/2026 - 03:29:16 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::5][scan-39af.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, ... show more [AUTORAVALT][[19/10/2026 - 03:29:16 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::5][scan-39af.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Br] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇭🇺 kranem	2026-10-17 15:00:45 UTC · (2 weeks ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-17T05:42:44Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-17T05:42:44Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 marcel-knorr.de	2026-10-17 03:33:14 UTC · (2 weeks ago)	[MK-VM3] Blocked by UFW	Brute-Force Port Scan
🇭🇺 kranem	2026-10-17 03:00:25 UTC · (2 weeks ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-17T00:35:22Z User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ch ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-17T00:35:22Z User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 show less	Bad Web Bot
🇭🇺 kranem	2026-10-16 09:00:43 UTC · (2 weeks ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-16T03:27:41Z User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ch ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-16T03:27:41Z User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 Lino Project	2026-10-16 06:29:32 UTC · (3 weeks ago)	2001:470:1:332::5 - - [16/Oct/2026:08:29:28 +0200] "\x16\x03\x01" 400 392 "-" "-" ...	Blog Spam
🇭🇺 kranem	2026-10-16 03:00:19 UTC · (3 weeks ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-16T02:02:14Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Fi ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-16T02:02:14Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0 show less	Bad Web Bot

Showing 16 to 30 of 2544 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇳 223.233.81.204

🇺🇦 194.44.8.140

🇳🇱 77.239.124.66

🇳🇱 45.148.10.141

🇰🇿 37.99.47.102

🇰🇷 220.87.238.187

🇩🇪 213.209.159.238

🇮🇳 103.87.106.237

🇱🇹 77.90.185.20

🇨🇳 60.16.198.139

🇺🇸 3.88.167.181

🇫🇷 207.180.210.81

🇺🇸 198.74.56.135

🇻🇳 171.252.152.193

🇨🇦 144.217.61.131

🇳🇱 77.67.26.248

🇺🇸 70.175.182.210

🇧🇪 35.210.223.144

🇺🇸 2620:24:c040:4::88

🇧🇷 205.210.31.167