AS218970 Amin NezhadKahnoji

Abuse reported against IP addresses announced by autonomous system 218970. If you run this network, the addresses below are a good place to start an abuse investigation.

In the last 30 days, 12 IP addresses in AS218970 Amin NezhadKahnoji were reported for abuse, in 74 reports altogether. 1 of them (8%) has a confidence score of 75 or more and is on the default blocklist. The most common reasons were Web Spam, Command & Control and Port Scan. Most of them are in United Kingdom.

12addresses reported, 30 days

1on the default blocklist (75+)

74reports against them

1 hsince the latest report

Most reported addresses

Address	Score	Reports	Categories	Last seen
🇬🇧217.60.242.61	80	18	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	1 h
🇬🇧217.60.242.57	63	11	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	4 h
🇬🇧217.60.242.62	55	10	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	13 h
🇬🇧217.60.242.50	54	7	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	4 h
🇬🇧217.60.242.76	50	5	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	28 h
🇬🇧217.60.242.38	38	3	DNS Poisoning Web Spam Port Scan SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	1 h
🇬🇧217.60.242.3	38	3	DNS Poisoning Web Spam Port Scan SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	1 h
🇬🇧217.60.242.25	38	4	DNS Poisoning Web Spam Port Scan SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	1 h
🇬🇧217.60.242.21	38	2	DNS Poisoning Web Spam Port Scan SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	1 h
🇬🇧217.60.242.63	36	5	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	37 h
🇬🇧217.60.242.58	30	4	Web Spam Port Scan Bad Web Bot Web App Attack Command & Control	4 h
🇬🇧217.60.242.51	29	2	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	28 h

What they were reported for

Where they are

🇬🇧 United Kingdom12

Block them

The blocklist holds every address with a confidence of 75 or more, in nine formats for firewalls, web servers and SIEMs. Download it with a free API key:

curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt"

See the integration guides for nginx, fail2ban, pfSense, MikroTik and more, or the API reference.

Figures cover the last 30 days and are refreshed hourly; last updated 9 minutes ago.