JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:470:1:c84::17

2001:470:1:c84::17

Recent Activity IPv6 SLAAC Note

2,745 reports found in our database

100% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

The Shadowserver Foundation, Inc.

Usage Type

Fixed Line ISP

ASN

AS6939

Hostname(s)

scan-07o.shadowserver.io

Domain Name

shadowserver.org

Country

🇺🇸 United States of America

City

Pleasanton, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2001:470:1:c84::17:

This IP address has been reported a total of 2,745 times from 221 distinct sources. 2001:470:1:c84::17 was first reported on October 25th 2021, and the most recent report was 10 hours ago. In the last 60 days, the top reporter locations were: Germany with 48 reports; United States of America with 24 reports; France with 9 reports. The most common categories in these recent reports were: Port Scan 46 times; Brute-Force 43 times; SSH 28 times; Web App Attack 26 times; Bad Web Bot 25 times; Other 36 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 pjfasano	2026-09-08 08:56:54 (10 hours ago)	Sep 8 02:11:53 fermi dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 0 se ... show more Sep 8 02:11:53 fermi dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=2001:470:1:c84::17, lip=2001:470:1f10:17d::2, TLS: Connection closed, session=<uEMoQu9aQvkgAQRwAAEMhAAAAAAAAAAX> Sep 8 02:11:59 fermi dovecot: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=2001:470:1:c84::17, lip=2001:470:1f10:17d::2, session=<oxx7Qu9aqOMgAQRwAAEMhAAAAAAAAAAX> Sep 8 08:56:48 fermi dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=2001:470:1:c84::17, lip=2001:470:1f10:17d::2, TLS handshaking: Connection closed, session=<zx4/6vRaCvYgAQRwAAEMhAAAAAAAAAAX> Sep 8 08:56:53 fermi dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=2001:470:1:c84::17, lip=2001:470:1f10:17d::2, TLS handshaking: Connection closed, session=<s/mE6vRaEvYgAQRwAAEMhAAAAAAAAAAX> Sep 8 08:56:53 fermi dovecot: imap-login: Disconnected: Connection ... show less	Brute-Force SSH
🇩🇰 powerhostingdk	2026-09-08 08:22:41 (11 hours ago)	[mailserver] CrowdSec detected mailscanner/global-spam-aggregate (31 events). Automated abuse report ... show more [mailserver] CrowdSec detected mailscanner/global-spam-aggregate (31 events). Automated abuse report. show less	Brute-Force
🇳🇱 tr1n	2026-09-08 05:40:48 (14 hours ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| ASN: 6939 (Hurricane ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| ASN: 6939 (Hurricane Electric LLC) \| Protocol: HTTP/1.1 (GET) \| Endpoint: / \| Timestamp: 2026-09-08T05:40:48Z \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 show less	Bad Web Bot
🇭🇺 kranem	2026-09-08 03:00:13 (16 hours ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-08T02:21:00Z User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 show less	Bad Web Bot
🇩🇪 Benny Pedersen	2026-09-08 01:40:48 (18 hours ago)	Sep 8 03:40:37 localhost postfix/postscreen[319556]: HANGUP after 4.1 from [2001:470:1:c84::17]:505 ... show more Sep 8 03:40:37 localhost postfix/postscreen[319556]: HANGUP after 4.1 from [2001:470:1:c84::17]:50552 in tests before SMTP handshake Sep 8 03:40:42 localhost postfix/postscreen[319556]: HANGUP after 4.1 from [2001:470:1:c84::17]:50556 in tests before SMTP handshake ... show less	Brute-Force
🇭🇺 kranem	2026-09-07 06:00:11 (1 day ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-07T05:37:45Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 show less	Bad Web Bot
🇺🇸 drewf.ink	2026-09-07 02:41:00 (1 day ago)	[02:41] Port scanning. Port(s) scanned: TCP/2096	Port Scan
🇺🇸 VanKoh	2026-09-06 07:21:50 (2 days ago)	2001:470:1:c84::17 - - [06/Sep/2026:01:21:32 -0600] "GET / HTTP/1.1" 301 5 "-" "Mozilla/5.0 (Macinto ... show more 2001:470:1:c84::17 - - [06/Sep/2026:01:21:32 -0600] "GET / HTTP/1.1" 301 5 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" 2001:470:1:c84::17 - - [06/Sep/2026:01:21:48 -0600] "GET / HTTP/1.1" 301 5 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0" 2001:470:1:c84::17 - - [06/Sep/2026:01:21:49 -0600] "GET / HTTP/1.1" 301 162 "https://[2605:a140:2237:1307::1]/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0" ... show less	Port Scan Web App Attack
🇩🇪 seal	2026-09-05 07:21:24 (3 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	SSH Brute-Force
🇭🇺 kranem	2026-09-05 03:00:07 (3 days ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: H ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 6939 (Hurricane Electric LLC) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-05T02:17:37Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.78 show less	Bad Web Bot
🇹🇭 Sawasdee	2026-09-04 03:21:06 (4 days ago)	Port Scan/VNC login attempt ...	Port Scan
🇫🇷 ✨	2026-09-04 00:54:09 (4 days ago)	Rule : FTP IP in black list	FTP Brute-Force
🇩🇰 Deveroonie	2026-09-02 03:16:01 (6 days ago)	2026-09-02T04:15:57.077568+01:00 server-1 sshd[2091091]: Invalid user from 2001:470:1:c84::17 port ... show more 2026-09-02T04:15:57.077568+01:00 server-1 sshd[2091091]: Invalid user from 2001:470:1:c84::17 port 22746 2026-09-02T04:16:01.437767+01:00 server-1 sshd[2091091]: Connection closed by invalid user 2001:470:1:c84::17 port 22746 [preauth] ... show less	Hacking Brute-Force SSH
🇩🇪 VentryShield	2026-09-02 00:05:09 (6 days ago)	p0t honeypot: unknown connection on port 8080/tcp, 227 bytes received from client	Port Scan
Anonymous	2026-09-01 06:36:10 (1 week ago)	Blocked by UFW [3333/tcp] \| SPT: 33640 \| TTL: null \| LEN: 60 \| TOS: null • Reported by: github.com/s ... show more Blocked by UFW [3333/tcp] \| SPT: 33640 \| TTL: null \| LEN: 60 \| TOS: null • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 2745 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 222.142.39.80

🇭🇰 165.154.40.84

🇮🇳 103.238.106.11

🇩🇪 69.5.169.236

🇸🇬 68.178.170.218

🇹🇼 1.168.228.188

🇹🇭 203.170.192.251

🇺🇸 92.118.57.209

🇷🇺 78.155.212.3

🇩🇪 69.5.169.235

🇩🇪 69.5.169.233

🇸🇬 43.134.11.201

🇺🇸 209.141.46.157

🇨🇦 207.219.222.29

🇧🇩 202.84.43.58

🇲🇿 196.28.236.219

🇺🇦 194.28.89.220

🇫🇷 193.203.15.136

🇿🇦 154.0.166.123

🇫🇷 152.228.238.65