2604:a940:301:225:0:56::
Neutral Activity
There is no recent abuse activity, or the IP address is whitelisted.
Whitelisted Subnet
Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.
IPv6 SLAAC Note Public IPv6 addresses may implement the SLAAC privacy extension. With SLAAC, the interface identifier is randomly generated. SLAAC also implements a configurable time out, so that the original IPv6 interface addresses will be discarded in favor of a new interface identifier.2604:a940:301:225:0:56:: is on our whitelist as Cortex Xpanse via the subnet 2604:a940:301:225::/64.
- ISP
- Palo Alto Networks, Inc
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS396982
- Domain Name
- paloaltonetworks.com
- Country
- 🇺🇸 United States of America
- City
- Mountain View, California
Abuse Reports
Total reports
27 from
12 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week.
This IP is on our whitelist as Cortex Xpanse.
Shared services like this are often reported for traffic that is not abuse, so review the reports
before blocking.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇫🇷 manah |
Port scan and/or repeated connection to closed ports (daily report)
|
Port Scan | |
| 🇩🇪 jann |
Honeypot: connection to unused port 445 at 2026-11-12 19:55:58 UTC. No service runs there, any connection is unsolicited scanning.
|
Port Scan | |
| 🇺🇸 thororen |
Blocked by UFW [59382/tcp]
Source port: 50658
TTL: null
Packet length: 64
TOS: null
This report was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| Anonymous |
Fail2Ban triggered
|
Spoofing Port Scan | |
| 🇫🇮 kumiko |
[2026-11-06 00:56:14] Unauthorized port scan/probing (3 times on ports 10443, 20256, 30010) Blocked by UFW
|
Port Scan | |
| 🇫🇮 kumiko |
[2026-11-05 23:38:14] Unauthorized port scan/probing (3 times on ports 8003, 9000, 20257) Blocked by UFW
|
Port Scan | |
| 🇩🇪 mattk |
port scan
|
Port Scan | |
| 🇺🇸 xmission.com |
Blocked by UFW (TCP on 8012)
Source port: 51837
Packet length: 60
This report (for 2604:a940:0301:0225:0000:0056:0000:0000) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇺🇸 en0 |
2604:a940:0301:0225:0000:0056:0000:0000 was recorded 3 times by 1 hosts attempting to connect to 3 unique ports. Incident counter (4h, 24h, all-time): 3, 3, 3
|
Port Scan | |
| 🇫🇮 kumiko |
[2026-11-05 21:21:39] Unauthorized port scan/probing (3 times on ports 2080, 3306, 8899) Blocked by UFW
|
Port Scan | |
| 🇺🇸 xmission.com |
Blocked by UFW (TCP on 11553)
Source port: 53068
Packet length: 60
This report (for 2604:a940:0301:0225:0000:0056:0000:0000) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇺🇸 xmission.com |
Blocked by UFW (TCP on 5555)
Source port: 52010
Packet length: 60
This report (for 2604:a940:0301:0225:0000:0056:0000:0000) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇺🇸 xmission.com |
Blocked by UFW (TCP on 20257)
Source port: 51232
Packet length: 60
This report (for 2604:a940:0301:0225:0000:0056:0000:0000) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇩🇪 EinfxchFinn |
Unauthorized connection attempt to port 53300 from 2604:a940:0301:0225:0000:0056:0000:0000
|
Port Scan | |
| 🇩🇪 EinfxchFinn |
Unauthorized connection attempt to port 8899 from 2604:a940:0301:0225:0000:0056:0000:0000
|
Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown