2600:1900:4090:23f:0:397:0:5
United States · GOOGLE-CLOUD-PLATFORM · Data Center
90/100
Fraud score
critical risk
What we know about 2600:1900:4090:23f:0:397:0:5.
VPN
Clean
Proxy
Clean
Tor
Clean
Relay
Clean
Datacenter
Detected
Mobile
Clean
Active command & control (C2) server used to coordinate malware operations. Identified as part of a botnet network. SMTP and mail server abuse including spam relay and credential harvesting. Sustained malicious activity, confirmed by our honeypot sensors and multiple community reports. Hosted on Google Cloud infrastructure
Network
- ASN
- AS396982
- Organization
- GOOGLE-CLOUD-PLATFORM
- ISP
- GOOGLE-CLOUD-PLATFORM
- Connection type
- Data Center
- Cloud provider
- Google Cloud
- Residential proxy
- No
- Shared connection
- No
Location
- Country
- United States (US)
- Region
- –
- City
- –
- Coordinates
- –
- Timezone
- –
- rDNS
- –
History
- First seen
- Sep 23, 2026
- Last seen
- Nov 2, 2026
- Times seen
- 40
Threat signatures · 4
No reports on 2600:1900:4090:23f:0:397:0:5 yet.
Nobody has reported 2600:1900:4090:23f:0:397:0:5 yet. If it attacked you, be the first: every report feeds the free, open database that everyone can use.
2600:1900:4090:23f:0:397:0:5, answered.
No. 2600:1900:4090:23f:0:397:0:5 does not match any VPN, proxy, or Tor signature in our data. It looks like a datacenter / hosting IP.
FFraud scores 2600:1900:4090:23f:0:397:0:5 at 90/100 (critical risk) because Active command & control (C2) server used to coordinate malware operations. Identified as part of a botnet network. SMTP and mail server abuse including spam relay and credential harvesting. Sustained malicious activity, confirmed by our honeypot sensors and multiple community reports. Hosted on Google Cloud infrastructure We recommend blocking or challenging it.
2600:1900:4090:23f:0:397:0:5 is operated by GOOGLE-CLOUD-PLATFORM (AS396982), located in United States.
The score reflects medium-confidence signals: Active command & control (C2) server used to coordinate malware operations. Identified as part of a botnet network. SMTP and mail server abuse including spam relay and credential harvesting. Sustained malicious activity, confirmed by our honeypot sensors and multiple community reports. Hosted on Google Cloud infrastructure FFraud only lists an IP once it is independently confirmed at least twice, by our honeypot sensors and community reports.
Check another IP. One at a time, instantly.
2600:1900:4090:23f:0:397:0:5: fraud score 90 of 100, Critical
2600:1900:4090:23f:0:397:0:5
GOOGLE-CLOUD-PLATFORM · United States
90/100
Fraud score
- VPN: no
- Proxy: no
- Tor: no
- Datacenter: yes