AS20911 Net-Surf.net Ltd.

Abuse reported against IP addresses announced by autonomous system 20911. If you run this network, the addresses below are a good place to start an abuse investigation.

In the last 30 days, 21 IP addresses in AS20911 Net-Surf.net Ltd. were reported for abuse, in 23 reports altogether. None of them has a confidence score high enough for the default blocklist yet. The most common reasons were Malware Distribution, Brute-Force and SSH. Most of them are in Bulgaria.

21addresses reported, 30 days

0on the default blocklist (75+)

23reports against them

11 hsince the latest report

Most reported addresses

Address	Score	Reports	Categories	Last seen
🇧🇬194.169.175.38	29	2	Web Spam Port Scan Brute-Force Bad Web Bot SSH Malware Distribution	11 h
🇧🇬194.169.175.37	29	2	Web Spam Port Scan Brute-Force Bad Web Bot SSH Malware Distribution	11 h
🇧🇬95.214.27.49	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.48	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.47	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.38	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.33	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.32	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.31	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.30	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.29	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.194	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.183	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬194.169.175.49	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬194.169.175.48	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬194.169.175.107	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬194.169.175.106	18	1	Brute-Force SSH Malware Distribution	11 h
🇧🇬95.214.27.193	14	1	Web Spam Port Scan Bad Web Bot	20 h
🇧🇬178.254.250.133	14	1	Web Spam Port Scan Bad Web Bot	20 h
🇧🇬178.254.192.110	14	1	Web Spam Port Scan Bad Web Bot	20 h

What they were reported for

Where they are

🇧🇬 Bulgaria21

Block them

The blocklist holds every address with a confidence of 75 or more, in nine formats for firewalls, web servers and SIEMs. Download it with a free API key:

curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt"

See the integration guides for nginx, fail2ban, pfSense, MikroTik and more, or the API reference.

Figures cover the last 30 days and are refreshed hourly; last updated 54 minutes ago.