JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2001:470:2cc:1::1df

Recent Activity IPv6 SLAAC Note

Abuse confidence score ?

100% Critical

1,402 reports

142 reporters · latest 11 hours ago

ISP	The Shadowserver Foundation, Inc.
Usage Type	Fixed Line ISP
ASN	AS6939
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2001:470:2cc:1::1df

Export CSV

This IP address has been reported a total of 1,402 times from 142 distinct sources. 2001:470:2cc:1::1df was first reported on March 27th 2025, and the most recent report was 11 hours ago. In the last 60 days, the top reporter locations were: Germany with 56 reports; Turkey with 48 reports; United States of America with 41 reports. The most common categories in these recent reports were: Hacking 83 times; Web App Attack 74 times; Brute-Force 66 times; Port Scan 59 times; SSH 30 times; Other 96 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 oh.mg	2026-10-03 05:00:19 (11 hours ago)	(sshd) Failed SSH login from 2001:470:2cc:1::1df (Unknown): 1 in the last 3600 secs; Ports: ; Direc ... show more (sshd) Failed SSH login from 2001:470:2cc:1::1df (Unknown): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 05:00:07 joshua sshd[2751100]: Invalid user from 2001:470:2cc:1::1df port 6610 show less	Port Scan
🇺🇸 thororen	2026-10-03 02:04:25 (14 hours ago)	Blocked by UFW [8090/tcp] Source port: 56868 TTL: null Packet length: 64 TOS: null This report was ... show more Blocked by UFW [8090/tcp] Source port: 56868 TTL: null Packet length: 64 TOS: null This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇫🇮 kumiko	2026-10-03 00:43:33 (15 hours ago)	[2026-10-03 03:43:19] Unauthorized port scan/probing (3 times on port 2087) Blocked by UFW	Port Scan
🇺🇸 oukat	2026-10-02 09:02:33 (1 day ago)	SMTP abuse - provider/subnet blocked after receiving excessive spam	Phishing Email Spam
🇩🇪 xavier-momain.eu	2026-10-02 02:17:15 (1 day ago)	CrowdSec ban — scenario: ssh:bruteforce \| report #3	Brute-Force SSH
🇹🇷 neron	2026-10-01 22:06:37 (1 day ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇩🇪 DSK	2026-10-01 07:02:50 (2 days ago)	Unauthorized connection Drop [8088/tcp] #14658	Bad Web Bot
🇹🇷 neron	2026-09-30 22:06:38 (2 days ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇩🇪 gnb	2026-09-30 06:42:55 (3 days ago)	2026-09-30T08:42:53.251342+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470 ... show more 2026-09-30T08:42:53.251342+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:02cc:0001:0000:0000:0000:01df DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=752700 PROTO=TCP SPT=57968 DPT=4443 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T08:42:54.297161+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:02cc:0001:0000:0000:0000:01df DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=935794 PROTO=TCP SPT=57968 DPT=4443 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T08:42:55.321205+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:02cc:0001:0000:0000:0000:01df DST=(redacted) LEN=68 TC=0 HOPLIMIT=48 FLOWLBL=913897 PROTO=TCP SPT=57968 DPT=4443 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇹🇭 Sawasdee	2026-09-30 05:33:13 (3 days ago)	Port Scan/VNC login attempt ...	Port Scan
🇩🇪 gnb	2026-09-30 03:17:26 (3 days ago)	2026-09-30T05:17:23.361784+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470 ... show more 2026-09-30T05:17:23.361784+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:02cc:0001:0000:0000:0000:01df DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=891740 PROTO=TCP SPT=63260 DPT=8081 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T05:17:24.377188+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:02cc:0001:0000:0000:0000:01df DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=13523 PROTO=TCP SPT=63260 DPT=8081 WINDOW=43200 RES=0x00 SYN URGP=0 2026-09-30T05:17:25.397935+02:00 atlas kernel: [UFW BLOCK] IN=eth0 OUT= MAC=(redacted) SRC=2001:0470:02cc:0001:0000:0000:0000:01df DST=(redacted) LEN=68 TC=0 HOPLIMIT=47 FLOWLBL=471427 PROTO=TCP SPT=63260 DPT=8081 WINDOW=43200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 marcel-knorr.de	2026-09-30 02:28:07 (3 days ago)	[MK-VM3] Blocked by UFW	Brute-Force Port Scan
🇹🇷 neron	2026-09-29 17:51:38 (3 days ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇮🇹 matthew_eli	2026-09-29 09:45:06 (4 days ago)	Keenetic Firewall: Persistent traffic from Blacklisted IP. Blocked via Kernel/NFLOG. (2 hits in 24h) ... show more Keenetic Firewall: Persistent traffic from Blacklisted IP. Blocked via Kernel/NFLOG. (2 hits in 24h). [+ 2 new hits since last report] show less	Port Scan
🇫🇮 kumiko	2026-09-29 09:36:11 (4 days ago)	[2026-09-29 12:35:57] Unauthorized port scan/probing (3 times on port 449) Blocked by UFW	Port Scan

Showing 1 to 15 of 1402 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇭 61.245.11.90

🇧🇪 198.235.24.159

🇳🇱 195.242.119.58

🇺🇦 176.36.111.23

🇺🇸 173.46.91.35

🇮🇳 103.91.246.101

🇺🇸 35.222.197.208

🇨🇳 218.17.163.229

🇮🇩 210.79.190.251

🇭🇺 195.228.79.114

🇳🇴 194.127.199.9

🇨🇳 183.197.148.107

🇨🇴 181.234.165.133

🇷🇺 151.252.84.225

🇰🇷 112.216.120.67

🇩🇪 69.5.169.82

🇵🇰 39.34.152.200

🇵🇪 38.25.30.62

🇨🇳 27.155.172.239

🇦🇷 201.220.17.247