JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:470:1:332::4

2001:470:1:332::4 was found in our database!

This IP was reported 2,356 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	The Shadowserver Foundation, Inc.
Usage Type	Fixed Line ISP
ASN	AS6939
Hostname(s)	scan-38af.shadowserver.io
Domain Name	shadowserver.org
Country	🇺🇸 United States of America
City	Pleasanton, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2001:470:1:332::4

Whois 2001:470:1:332::4

IP Abuse Reports for 2001:470:1:332::4:

This IP address has been reported a total of 2,356 times from 200 distinct sources. 2001:470:1:332::4 was first reported on October 26th 2021, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 natdem.org	2026-06-25 08:25:32 (2 months ago)	SSH: 1 attempts, users: (empty)	SSH Brute-Force
🇺🇸 drewf.ink	2026-06-25 06:41:06 (2 months ago)	[06:41] Port scanning. Port(s) scanned: TCP/8888	Port Scan
🇭🇺 kranem	2026-06-25 03:01:13 (2 months ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-06-25T00:42:12Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 show less	Bad Web Bot
🇫🇷 0xNath	2026-06-24 08:01:36 (2 months ago)	2026-06-24T10:01:27.308542+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connectio ... show more 2026-06-24T10:01:27.308542+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=2001:470:1:332::4, lip=2a01:e0a:d4e:1280::2, session=<iddUSPtUjtUgAQRwAAEDMgAAAAAAAAAE> 2026-06-24T10:01:31.312453+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=2001:470:1:332::4, lip=2a01:e0a:d4e:1280::2, TLS: Connection closed, session=<ke+RSPtUbCQgAQRwAAEDMgAAAAAAAAAE> 2026-06-24T10:01:35.332997+02:00 srv1.renaudna.fr dovecot[1615]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=2001:470:1:332::4, lip=2a01:e0a:d4e:1280::2, session=<BkrPSPtUeCQgAQRwAAEDMgAAAAAAAAAE> ... show less	Brute-Force
🇮🇹 yvoictra	2026-06-24 07:58:24 (2 months ago)	2026-06-24T09:58:23.144731+02:00 muse sshd-session[1021412]: Invalid user from 2001:470:1:332::4 po ... show more 2026-06-24T09:58:23.144731+02:00 muse sshd-session[1021412]: Invalid user from 2001:470:1:332::4 port 12354 ... show less	Brute-Force SSH
Anonymous	2026-06-24 06:20:11 (2 months ago)	Probing\(3\) HTTP Ports ...	Bad Web Bot Web App Attack
🇭🇺 kranem	2026-06-24 03:00:42 (2 months ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-06-24T02:10:23Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0 show less	Bad Web Bot
🇭🇺 kranem	2026-06-23 09:02:39 (2 months ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-06-23T06:08:09Z User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0 show less	Bad Web Bot
🇺🇸 chronos	2026-06-22 06:31:08 (2 months ago)	[AUTORAVALT][[22/06/2026 - 03:31:06 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332 ... show more [AUTORAVALT][[22/06/2026 - 03:31:06 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::4][;; communications error to 127.0.0.53#53: timed out scan-38af.shadowserver.io] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to acce] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 LotPhantom	2026-06-20 06:20:19 (2 months ago)	2001:470:1:332::4 - - [20/Jun/2026:06:19:19 +0000] "GET / HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Window ... show more 2001:470:1:332::4 - - [20/Jun/2026:06:19:19 +0000] "GET / HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.160 Safari/537.36" "0" ... show less	Web App Attack
Anonymous	2026-06-20 05:32:39 (2 months ago)	Fail2Ban triggered	Web App Attack
🇺🇸 chronos	2026-06-15 23:42:56 (2 months ago)	[AUTORAVALT][[15/06/2026 - 20:42:56 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332 ... show more [AUTORAVALT][[15/06/2026 - 20:42:56 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::4][scan-38af.shadowserver.org] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. B] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇩🇪 ecs.ge	2026-06-15 21:34:18 (2 months ago)	Automatic Fail2Ban report from jail ssh: multiple matching events detected.	Brute-Force SSH
🇺🇸 chronos	2026-06-15 06:37:02 (2 months ago)	[AUTORAVALT][[15/06/2026 - 03:36:46 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332 ... show more [AUTORAVALT][[15/06/2026 - 03:36:46 -03:00 UTC] Attack from [Hurricane Electric LLC] [2001:470:1:332::4][scan-38af.shadowserver.org] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. B] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 shabi	2026-06-14 06:48:07 (2 months ago)	UFW Blocked [110/TCP] Source: 2001:0470:0001:0332:0000:0000:0000:0004:35820 Lenth: 60	Port Scan

Showing 136 to 150 of 2356 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 192.254.224.255

🇧🇷 187.33.59.116

🇺🇸 170.106.180.153

🇸🇬 148.72.211.211

🇩🇪 36.255.97.9

🇺🇸 20.55.77.88

🇯🇵 8.216.14.99

🇮🇷 185.236.37.15

🇷🇺 176.53.162.54

🇭🇰 152.32.129.154

🇩🇪 130.12.182.230

🇻🇳 116.109.213.222

🇮🇳 113.193.234.210

🇮🇩 103.205.82.50

🇳🇱 91.92.47.6

🇫🇷 88.180.200.130

🇺🇸 83.142.55.24

🇸🇬 47.128.42.128

🇪🇸 46.8.168.170

🇳🇱 34.6.157.142