JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:470:2cc:1::25f

2001:470:2cc:1::25f was found in our database!

This IP was reported 1,176 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	The Shadowserver Foundation, Inc.
Usage Type	Fixed Line ISP
ASN	AS6939
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2001:470:2cc:1::25f

Whois 2001:470:2cc:1::25f

IP Abuse Reports for 2001:470:2cc:1::25f:

This IP address has been reported a total of 1,176 times from 128 distinct sources. 2001:470:2cc:1::25f was first reported on April 17th 2025, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 kranem	2026-07-16 03:00:41 (1 month ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-07-16T00:45:54Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15 show less	Bad Web Bot
🇺🇸 drewf.ink	2026-07-15 05:14:37 (1 month ago)	[05:14] Port scanning. Port(s) scanned: TCP/8081	Port Scan
🇦🇹 centurion	2026-07-15 02:49:29 (1 month ago)	Unauthorized attempt on cendev [90/tcp] Source port: 43067 TTL: null Packet length: 60 TOS: null htt ... show more Unauthorized attempt on cendev [90/tcp] Source port: 43067 TTL: null Packet length: 60 TOS: null https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 VentryShield	2026-07-15 00:33:59 (1 month ago)	p0t honeypot: imap connection on port 143/tcp, 135 bytes received from client	Email Spam
🇨🇭 4server	2026-07-14 04:57:23 (1 month ago)	[TueJul1406:57:16.1990842026][security2:error][pid1477569:tid1477815][client2001:470:2cc:1::25f:0]Mo ... show more [TueJul1406:57:16.1990842026][security2:error][pid1477569:tid1477815][client2001:470:2cc:1::25f:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"2a02:29b8:dc01:545::625:de4f\"][uri\"/cgi-sys/defaultwebpage.cgi\"][unique_id\"alXBrIV-WjA3YYFYY-YNWwAAAAI\"] show less	Hacking Web App Attack
Anonymous	2026-07-13 08:49:45 (1 month ago)	2026-07-13T08:49:40.085916+00:00 Canada1 sshd-session[3287479]: Invalid user from 2001:470:2cc:1::2 ... show more 2026-07-13T08:49:40.085916+00:00 Canada1 sshd-session[3287479]: Invalid user from 2001:470:2cc:1::25f port 14086 2026-07-13T08:49:44.867513+00:00 Canada1 sshd-session[3287479]: Connection closed by invalid user 2001:470:2cc:1::25f port 14086 [preauth] ... show less	Brute-Force SSH
🇺🇸 drewf.ink	2026-07-13 08:23:37 (1 month ago)	[08:23] Port scanning. Port(s) scanned: TCP/5222	Port Scan
🇫🇮 6kilowatti	2026-07-13 07:41:12 (1 month ago)	2026-07-13T10:41:11.711672+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74 ... show more 2026-07-13T10:41:11.711672+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:18:fd:74:f4:53:e7:86:dd SRC=2001:0470:02cc:0001:0000:0000:0000:025f DST=2a10:f2c0:aaa8:3efc:0000:0000:0000:0001 LEN=60 TC=0 HOPLIMIT=236 FLOWLBL=0 PROTO=TCP SPT=38731 DPT=444 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 4server	2026-07-13 07:19:19 (1 month ago)	[MonJul1309:19:10.8585092026][security2:error][pid625691:tid625707][client2001:470:2cc:1::25f:0]ModS ... show more [MonJul1309:19:10.8585092026][security2:error][pid625691:tid625707][client2001:470:2cc:1::25f:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/cgi-sys/defaultwebpage.cgi\"][unique_id\"alSRbjEudrn_IWopDKam0wAAAIw\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 chronos	2026-07-13 06:54:38 (1 month ago)	[AUTORAVALT][[13/07/2026 - 03:54:35 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:2cc:1 ... show more [AUTORAVALT][[13/07/2026 - 03:54:35 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:2cc:1::25f][;; communications error to 127.0.0.53#53: timed out ;; communications error to 127.0.0.53#53: timed out ;; no servers could be reached] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, an] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 chronos	2026-07-13 06:29:25 (1 month ago)	[AUTORAVALT][[13/07/2026 - 03:29:23 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:2cc:1 ... show more [AUTORAVALT][[13/07/2026 - 03:29:23 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:2cc:1::25f][;; communications error to 127.0.0.53#53: timed out ;; communications error to 127.0.0.53#53: timed out ;; no servers could be reached] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, an] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇭🇺 kranem	2026-07-13 03:00:26 (1 month ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-07-13T00:40:57Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 drewf.ink	2026-07-13 02:09:33 (1 month ago)	[02:09] Port scanning. Port(s) scanned: TCP/8088	Port Scan
🇺🇦 oh.mg	2026-07-12 08:24:50 (1 month ago)	(sshd) Failed SSH login from 2001:470:2cc:1::25f (Unknown): 1 in the last 3600 secs; Ports: ; Direc ... show more (sshd) Failed SSH login from 2001:470:2cc:1::25f (Unknown): 1 in the last 3600 secs; Ports: ; Direction: 0; Trigger: LF_TRIGGER; Logs: 2026-07-12T08:24:45.027540+00:00 francesko sshd[1916485]: Invalid user from 2001:470:2cc:1::25f port 46610 show less	Brute-Force SSH
🇷🇴 SpamStopper	2026-07-12 08:06:58 (1 month ago)	Dovecot SSL Probe - IMAP Gate Knocking	Brute-Force Bad Web Bot

Showing 91 to 105 of 1176 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 206.189.102.188

🇳🇱 195.178.110.227

🇺🇸 172.236.228.220

🇧🇷 170.78.118.76

🇺🇸 162.216.149.30

🇨🇳 117.191.83.250

🇨🇳 117.156.234.57

🇩🇪 109.250.49.225

🇺🇸 98.42.29.31

🇳🇱 93.123.109.228

🇧🇬 79.124.62.230

🇺🇸 74.50.98.193

🇺🇸 66.132.195.15

🇺🇸 64.62.156.25

🇩🇪 43.228.157.17

🇺🇸 34.123.40.207

🇹🇼 34.81.244.123

🇺🇸 20.168.124.105

🇺🇸 13.218.60.160

🇭🇰 193.176.211.166