JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:470:1:fb5::9b

2001:470:1:fb5::9b was found in our database!

This IP was reported 367 times. Confidence of Abuse is 24%: ?

24%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	The Shadowserver Foundation, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS6939
Hostname(s)	scan-54-1a.shadowserver.io
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	San Francisco, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2001:470:1:fb5::9b

Whois 2001:470:1:fb5::9b

IP Abuse Reports for 2001:470:1:fb5::9b:

This IP address has been reported a total of 367 times from 38 distinct sources. 2001:470:1:fb5::9b was first reported on June 30th 2023, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 cazae	2026-06-22 00:12:45 (5 days ago)	Unauthorized attempt on debian [2087/tcp] Source port: 43943 TTL: null Packet length: 60 TOS: null ... show more Unauthorized attempt on debian [2087/tcp] Source port: 43943 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 6kilowatti	2026-06-14 03:24:57 (1 week ago)	2026-06-14T06:24:56.910623+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74 ... show more 2026-06-14T06:24:56.910623+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74:f4:53:e7:86:dd SRC=2001:0470:0001:0fb5:0000:0000:0000:009b DST=2a10:f2c0:aaa8:3efc:0000:0000:0000:0001 LEN=60 TC=0 HOPLIMIT=238 FLOWLBL=0 PROTO=TCP SPT=32949 DPT=10443 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 shabi	2026-05-27 00:05:18 (1 month ago)	UFW Blocked [8443/TCP] Source: 2001:0470:0001:0fb5:0000:0000:0000:009b:40827 Lenth: 60	Port Scan
🇺🇸 cazae	2026-05-10 07:01:34 (1 month ago)	Unauthorized attempt on debian [86/tcp] Source port: 48961 TTL: null Packet length: 60 TOS: null ht ... show more Unauthorized attempt on debian [86/tcp] Source port: 48961 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇭🇺 kranem	2026-05-09 06:00:53 (1 month ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-05-09T03:58:25Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57 show less	Bad Web Bot
🇫🇷 centurion	2026-05-09 01:41:59 (1 month ago)	Unauthorized attempt on uptime [1883/tcp] Source port: 52532 TTL: null Packet length: 60 TOS: null h ... show more Unauthorized attempt on uptime [1883/tcp] Source port: 52532 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 6kilowatti	2026-05-09 00:51:34 (1 month ago)	2026-05-09T03:51:34.199427+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74 ... show more 2026-05-09T03:51:34.199427+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74:f4:53:e7:86:dd SRC=2001:0470:0001:0fb5:0000:0000:0000:009b DST=2a10:f2c0:aaa8:3efc:0000:0000:0000:0001 LEN=60 TC=0 HOPLIMIT=241 FLOWLBL=0 PROTO=TCP SPT=38229 DPT=8443 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 en0	2026-04-22 08:33:56 (2 months ago)	2001:0470:0001:0fb5:0000:0000:0000:009b was recorded attempting unexpectedly to open an IPv6 Protoco ... show more 2001:0470:0001:0fb5:0000:0000:0000:009b was recorded attempting unexpectedly to open an IPv6 Protocol 41 tunnel. show less	Port Scan
🇫🇮 6kilowatti	2026-04-21 02:26:03 (2 months ago)	2026-04-21T05:26:02.720602+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74 ... show more 2026-04-21T05:26:02.720602+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74:f4:53:e7:86:dd SRC=2001:0470:0001:0fb5:0000:0000:0000:009b DST=2a10:f2c0:aaa8:3efc:0000:0000:0000:0001 LEN=60 TC=0 HOPLIMIT=240 FLOWLBL=0 PROTO=TCP SPT=54008 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 shabi	2026-04-21 01:53:40 (2 months ago)	UFW Blocked [449/TCP] Source: 2001:0470:0001:0fb5:0000:0000:0000:009b:44662 Lenth: 60	Port Scan
🇺🇸 xmission.com	2026-04-17 07:19:34 (2 months ago)	Blocked by UFW (TCP on 5443) Source port: 56257 Packet length: 60 This report (for 2001:0470:0001:0 ... show more Blocked by UFW (TCP on 5443) Source port: 56257 Packet length: 60 This report (for 2001:0470:0001:0fb5:0000:0000:0000:009b) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 shabi	2026-02-15 01:18:26 (4 months ago)	UFW Blocked [49667/TCP] Source: 2001:0470:0001:0fb5:0000:0000:0000:009b:43189 Lenth: 60	Port Scan
🇫🇮 as211431.net	2026-01-28 04:28:14 (4 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 shabi	2026-01-14 14:12:39 (5 months ago)	UFW Blocked [49670/TCP] Source: 2001:0470:0001:0fb5:0000:0000:0000:009b:48534 Lenth: 60	Port Scan
🇩🇪 403veli	2026-01-03 15:20:34 (5 months ago)	Confirmed malicious activity observed via T-Pot honeypot Observed 2 events on port 8090 (flow) from ... show more Confirmed malicious activity observed via T-Pot honeypot Observed 2 events on port 8090 (flow) from 2026-01-03T15:20:34.326000+00:00 to 2026-01-03T18:02:44.256000+00:00. Sample: {"src_port": 39773, "dest_port": 8090, "event_type": "flow", "src_ip": "2001:0470:0001:0fb5:0000:0000:0000:009b"} show less	Exploited Host

Showing 1 to 15 of 367 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.254

🇷🇸 185.71.88.91

🇨🇴 143.105.99.197

🇯🇵 8.221.141.177

🇪🇸 193.56.167.59

🇳🇱 176.65.139.217

🇧🇷 160.238.26.174

🇹🇷 159.146.75.247

🇺🇸 107.150.103.155

🇺🇸 73.248.14.105

🇫🇷 51.178.114.78

🇧🇷 43.164.195.160

🇯🇵 8.216.67.195

🇨🇦 208.96.233.67

🇪🇸 188.26.195.9

🇳🇱 176.65.148.97

🇳🇱 176.65.139.249

🇺🇸 162.241.190.226

🇺🇸 159.223.141.184

🇨🇳 117.159.93.197