JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2001:470:1:fb5::2a0

Recent Activity IPv6 SLAAC Note

Abuse confidence score ?

100% Critical

1,276 reports

141 reporters · latest 1 day ago

ISP	The Shadowserver Foundation, Inc.
Usage Type	Fixed Line ISP
ASN	AS6939
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	Pleasanton, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2001:470:1:fb5::2a0

Export CSV

This IP address has been reported a total of 1,276 times from 141 distinct sources. 2001:470:1:fb5::2a0 was first reported on March 18th 2025, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: Germany with 40 reports; United States of America with 34 reports; Hungary with 12 reports. The most common categories in these recent reports were: Brute-Force 47 times; Port Scan 46 times; Hacking 26 times; Bad Web Bot 24 times; Web App Attack 23 times; Other 61 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-09-30 22:06:38 (2 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇩🇪 keep_out	2026-09-30 06:03:02 (2 weeks ago)	Probing\(3\) HTTP Ports ...	Bad Web Bot Web App Attack
🇩🇪 gnb	2026-09-30 05:49:25 (2 weeks ago)	2026-09-30T07:49:22.833192+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470 ... show more 2026-09-30T07:49:22.833192+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=736853 PROTO=TCP SPT=35516 DPT=2096 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T07:49:23.878268+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=997356 PROTO=TCP SPT=35516 DPT=2096 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T07:49:24.907272+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=46 FLOWLBL=566163 PROTO=TCP SPT=35516 DPT=2096 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 gnb	2026-09-30 01:39:47 (2 weeks ago)	2026-09-30T03:39:44.661568+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470 ... show more 2026-09-30T03:39:44.661568+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=84030 PROTO=TCP SPT=52198 DPT=5665 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T03:39:45.706992+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=361057 PROTO=TCP SPT=52198 DPT=5665 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T03:39:46.725994+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=241614 PROTO=TCP SPT=52198 DPT=5665 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇹🇷 neron	2026-09-29 17:51:38 (2 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇩🇪 xavier-momain.eu	2026-09-29 11:40:22 (2 weeks ago)	CrowdSec ban — scenario: ssh:bruteforce \| report #2	Brute-Force SSH
🇩🇪 DSK	2026-09-29 08:06:06 (2 weeks ago)	Unauthorized connection Drop [2087/tcp] #13423	Bad Web Bot
🇹🇷 neron	2026-09-28 11:51:38 (2 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 chronos	2026-09-28 06:28:24 (2 weeks ago)	[AUTORAVALT][[28/09/2026 - 03:28:23 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:fb5 ... show more [AUTORAVALT][[28/09/2026 - 03:28:23 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:fb5::2a0][scan-78-1f.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing.] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇮🇹 matthew_eli	2026-09-28 03:45:06 (2 weeks ago)	Keenetic Firewall: Persistent traffic from Blacklisted IP. Blocked via Kernel/NFLOG. (2 hits in 24h) ... show more Keenetic Firewall: Persistent traffic from Blacklisted IP. Blocked via Kernel/NFLOG. (2 hits in 24h). [+ 2 new hits since last report] show less	Port Scan
🇩🇪 keep_out	2026-09-28 02:07:07 (2 weeks ago)	Probing\(3\) HTTP Ports ...	Bad Web Bot Web App Attack
🇩🇪 gnb	2026-09-28 00:56:00 (2 weeks ago)	2026-09-28T02:55:58.197206+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470 ... show more 2026-09-28T02:55:58.197206+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=1004487 PROTO=TCP SPT=10580 DPT=8081 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-28T02:55:59.253220+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=505998 PROTO=TCP SPT=10580 DPT=8081 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-28T02:56:00.273392+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:0001:0fb5:0000:0000:0000:02a0 DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=961928 PROTO=TCP SPT=10580 DPT=8081 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇹🇷 neron	2026-09-27 11:51:47 (2 weeks ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 cazae	2026-09-27 09:22:04 (2 weeks ago)	Unauthorized attempt on debian [8880/tcp] Source port: 38528 TTL: null Packet length: 60 TOS: null ... show more Unauthorized attempt on debian [8880/tcp] Source port: 38528 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 as211431.net	2026-09-26 08:07:02 (3 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot

Showing 46 to 60 of 1276 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 110.248.184.210

🇫🇷 51.38.224.114

🇬🇧 217.154.35.203

🇳🇱 194.50.16.253

🇻🇳 160.250.132.238

🇻🇳 123.31.31.125

🇵🇱 95.214.53.157

🇷🇴 80.94.92.179

🇳🇱 45.148.10.152

🇨🇳 218.203.179.228

🇹🇼 198.235.24.85

🇫🇷 169.58.235.1

🇰🇷 121.180.212.162

🇨🇳 121.43.118.130

🇦🇲 91.196.38.75

🇺🇸 72.56.179.243

🇧🇪 34.62.116.145

🇦🇷 190.122.240.80

🇮🇳 117.250.226.90

🇳🇱 104.23.172.33