What is AutoShun?
AutoShun is a collaborative threat intelligence project operated by Sentinel IPS that aggregates IP and domain intelligence from a distributed network of shunt sensors. It tracks sources involved in SSH brute-force attacks, port scanning, and distributed attack campaigns. Their blocklist is widely used by network administrators and integrated into firewall rule sets and enterprise security appliances to automatically block known attack sources.
Why AutoShun flags legitimate domains
- Your server IP appeared in SSH brute-force attack logs monitored by Sentinel IPS sensors
- A compromised user account or bot on your hosting was used for scanning activity
- Your shared hosting IP block was flagged due to activity from another tenant
- A VPN or proxy IP associated with your infrastructure triggered attack detection
- Automated vulnerability scanning tools used your IP as a source address
What a listing means for your business
AutoShun data is pulled directly into firewall blocklists and network security appliances. A listing causes your IP or domain to be blocked at the perimeter of organizations using AutoShun feeds, often without any review or notification, simply because your address appeared in an attack sensor log.
How BrandsDefender gets you delisted
We verify that your domain is clean, prepare the evidence AutoShun needs, file the false positive dispute through the right channel and follow up until the flag is removed. No cure, no pay.
Frequently asked questions
Does AutoShun list domains or just IP addresses?
AutoShun primarily tracks malicious IPs, but domain-to-IP associations mean your domain can be flagged by association if your hosting IP appears in their attack logs.
How do I know if AutoShun is blocking my site?
AutoShun-based blocks are applied silently at the firewall level. Affected users simply cannot reach your site without any browser warning. Our team can confirm whether you are listed and begin the removal process.