JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:67c:289c:2::234

2001:67c:289c:2::234 was found in our database!

This IP was reported 97 times. Confidence of Abuse is 19%: ?

19%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Foreningen for digitala fri- och rattigheter
Usage Type	Fixed Line ISP
ASN	AS198093
Hostname(s)	tor-exit-read-me.dfri.se
Domain Name	dfri.net
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2001:67c:289c:2::234

Whois 2001:67c:289c:2::234

IP Abuse Reports for 2001:67c:289c:2::234:

This IP address has been reported a total of 97 times from 14 distinct sources. 2001:67c:289c:2::234 was first reported on December 28th 2022, and the most recent report was 6 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-15 22:12:23 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 18:12:12.140665 2026] [security2:error] [pid 27702:tid 27702] [client 2001:67c:289c:2::234:38516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.soundtrax.net"] [uri "/.git/config"] [unique_id "ajB4vFYbSfUDq0mwRvbUjQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-14 05:16:25 (1 week ago)	Blocked by UFW (TCP on 8333) Source port: 56406 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 56406 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-05-28 08:09:42 (3 weeks ago)	Blocked by UFW (TCP on 9999) Source port: 34274 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 9999) Source port: 34274 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Ping of Death
🇺🇸 xmission.com	2026-05-15 21:26:48 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 11482 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 11482 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-05-07 04:46:50 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 8572 Packet length: 80 This report (for 2001:067c:289c:00 ... show more Blocked by UFW (TCP on 8333) Source port: 8572 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-04-26 21:01:29 (1 month ago)	2026-04-26 08:00:23,668 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::234 2026- ... show more 2026-04-26 08:00:23,668 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::234 2026-04-26 12:01:23,370 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::234 2026-04-26 18:01:21,113 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::234 2026-04-26 21:01:18,143 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::234 2026-04-27 00:01:28,347 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::234 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-25 04:51:38 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 00:51:35.339523 2026] [security2:error] [pid 20415:tid 20415] [client 2001:67c:289c:2::234:39348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "soonerstone.com"] [uri "/wp-config.phpo"] [unique_id "aexIVywmo8v9OiYa0zXs6wAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-04-24 07:54:38 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 37262 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 37262 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-04-09 12:08:30 (2 months ago)	Blocked by UFW (TCP on 8333) Source port: 54834 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 54834 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0234) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇮🇹 VHosting	2026-03-26 20:41:30 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-07 13:19:56 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 07 08:19:51.726390 2026] [security2:error] [pid 30995:tid 30995] [client 2001:67c:289c:2::234:63478] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|diamondtrailerserv.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "diamondtrailerserv.com"] [uri "/wpadmin.sql"] [unique_id "aawl952FpB1my7GETRCCNAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-02 13:18:41 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 02 08:18:33.567713 2026] [security2:error] [pid 22403:tid 22403] [client 2001:67c:289c:2::234:46188] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.lemoulinavent.org\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.lemoulinavent.org"] [uri "/wp_admin.sql"] [unique_id "aaWOKQvGvrRmhRtgeDDxvgAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-23 20:16:13 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 15:16:05.443850 2026] [security2:error] [pid 29088:tid 29088] [client 2001:67c:289c:2::234:13708] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|dwightbrown.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dwightbrown.com"] [uri "/tbrown_db.sql"] [unique_id "aZy1heAkNICTimgi7sQC0gAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-07 18:05:41 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::234 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 07 13:05:34.041782 2026] [security2:error] [pid 8729:tid 8729] [client 2001:67c:289c:2::234:51352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.kinkycouple4u.com"] [uri "/.git/config"] [unique_id "aYd-7rhnVyq0FHcXBWfkjQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-02-02 23:00:09 (4 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-02-01. show less	Hacking Web App Attack SSH

Showing 1 to 15 of 97 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 206.81.6.36

🇧🇷 205.210.31.231

🇺🇸 165.232.144.228

🇩🇪 45.135.194.113

🇧🇪 207.175.96.215

🇲🇽 177.229.197.38

🇺🇸 172.66.162.109

🇺🇸 136.111.79.167

🇫🇷 51.68.111.243

🇷🇺 31.173.80.56

🇺🇸 23.94.23.226

🇺🇸 20.171.127.66

🇺🇸 3.21.163.185

🇹🇼 198.235.24.65

🇹🇭 184.22.115.169

🇰🇷 121.132.27.238

🇮🇩 103.97.101.25

🇸🇬 97.74.86.176

🇫🇷 91.231.89.175

🇱🇹 81.30.98.49