AS57509 L&L Investment Ltd.

Abuse reported against IP addresses announced by autonomous system 57509. If you run this network, the addresses below are a good place to start an abuse investigation.

In the last 30 days, 11 IP addresses in AS57509 L&L Investment Ltd. were reported for abuse, in 47 reports altogether. 1 of them (9%) has a confidence score of 75 or more and is on the default blocklist. The most common reasons were Malware Distribution, Brute-Force and SSH. Most of them are in Bulgaria.

11addresses reported, 30 days

1on the default blocklist (75+)

47reports against them

1 hsince the latest report

Most reported addresses

Address	Score	Reports	Categories	Last seen
🇧🇬91.191.209.198	75	9	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	7 h
🇧🇬91.191.209.46	71	10	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	10 h
🇧🇬91.191.209.98	68	9	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	10 h
🇧🇬91.191.209.118	64	9	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	10 h
🇧🇬91.191.209.9	39	3	Web Spam Port Scan Hacking Bad Web Bot Vulnerability Scan	10 h
🇧🇬91.191.209.93	27	1	FTP Brute-Force Phishing Open Proxy Web Spam Brute-Force Web App Attack Command & Control HTTP Flood	1 h
🇧🇬91.191.209.74	18	1	Brute-Force SSH Malware Distribution	10 h
🇧🇬91.191.209.234	18	1	Brute-Force SSH Malware Distribution	10 h
🇧🇬91.191.209.218	18	1	Brute-Force SSH Malware Distribution	10 h
🇧🇬91.191.209.202	18	1	Brute-Force SSH Malware Distribution	10 h
🇧🇬91.191.209.78	14	2	DNS Poisoning SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	2 d

What they were reported for

Where they are

🇧🇬 Bulgaria11

Block them

The blocklist holds every address with a confidence of 75 or more, in nine formats for firewalls, web servers and SIEMs. Download it with a free API key:

curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt"

See the integration guides for nginx, fail2ban, pfSense, MikroTik and more, or the API reference.

Figures cover the last 30 days and are refreshed hourly; last updated 47 minutes ago.