JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:67c:289c:2::235

2001:67c:289c:2::235

Recent Activity IPv6 SLAAC Note

148 reports found in our database

4% ▲ ▲ ▲ Caution

Abuse confidence score ?

ISP

Foreningen for digitala fri- och rattigheter

Usage Type

Fixed Line ISP

ASN

AS198093

Hostname(s)

tor-exit-read-me.dfri.se

Domain Name

dfri.net

Country

🇸🇪 Sweden

City

Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2001:67c:289c:2::235:

This IP address has been reported a total of 148 times from 20 distinct sources. 2001:67c:289c:2::235 was first reported on November 5th 2022, and the most recent report was 3 days ago. In the last 60 days, the only reporter location was: United States of America with 4 reports. The only category in these recent reports was: Port Scan 4 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-09-04 17:18:24 (3 days ago)	Blocked by UFW (TCP on 8333) Source port: 59938 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 59938 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-08-23 16:24:00 (2 weeks ago)	Blocked by UFW (TCP on 8333) Source port: 31520 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 31520 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-08-21 17:11:56 (2 weeks ago)	Blocked by UFW (TCP on 8333) Source port: 10940 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 10940 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-07-28 10:09:06 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 48360 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 48360 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-27 01:11:17 (2 months ago)	Blocked by UFW (TCP on 8333) Source port: 48058 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 48058 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇪🇸 gnom4ik	2026-06-26 19:03:58 (2 months ago)	ban-reviewer auto report; ip=2001:67c:289c:2::235; scenario=http:scan; scenario_context=http:scan,to ... show more ban-reviewer auto report; ip=2001:67c:289c:2::235; scenario=http:scan; scenario_context=http:scan,tor-exit-nodes; verdict=valid_ban; confidence=0.92; categories=14,15,18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high show less	Port Scan Hacking Brute-Force SSH
🇵🇱 sefinek.net	2026-06-26 14:37:13 (2 months ago)	Triggered Cloudflare WAF (firewallCustom) from T1. Action: BLOCK \| Protocol: HTTP/2 (GET) \| Endpoint ... show more Triggered Cloudflare WAF (firewallCustom) from T1. Action: BLOCK \| Protocol: HTTP/2 (GET) \| Endpoint: / \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-11 22:59:06 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:58:58.215780 2026] [security2:error] [pid 2026:tid 2026] [client 2001:67c:289c:2::235:37570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.pikcasa.com"] [uri "/.git/config"] [unique_id "ais9sq0ILYwS5ytq-rhVAQAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-07 05:41:38 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 01:41:31.089438 2026] [security2:error] [pid 28860:tid 28860] [client 2001:67c:289c:2::235:24642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.dynarol.com"] [uri "/.git/config"] [unique_id "aiUEi-Bl6pm6vufqqB8XdQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 chronos	2026-06-01 06:31:37 (3 months ago)	[AUTORAVALT][[01/06/2026 - 03:31:36 -03:00 UTC] Attack from [2001:67c:289c:2::235][tor-exit-read-me. ... show more [AUTORAVALT][[01/06/2026 - 03:31:36 -03:00 UTC] Attack from [2001:67c:289c:2::235][tor-exit-read-me.dfri.se] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Brute-Force -> Credential] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
🇺🇸 chronos	2026-05-31 10:15:59 (3 months ago)	[AUTORAVALT][[31/05/2026 - 07:15:58 -03:00 UTC] Attack from [2001:67c:289c:2::235][tor-exit-read-me. ... show more [AUTORAVALT][[31/05/2026 - 07:15:58 -03:00 UTC] Attack from [2001:67c:289c:2::235][tor-exit-read-me.dfri.se] Action: BLocKed Phishing -> Phishing websites and/or email. Email Spam -> Spam email content, infected attachments, and phishing emails. Hacking... Unauthorized attempts to access the server. Spoofing -> Email sender spoofing. Brute-Force -> Credential] ... show less	Brute-Force Email Spam Spoofing Phishing Hacking
Anonymous	2026-04-26 21:01:29 (4 months ago)	2026-04-26 08:00:23,738 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235 2026- ... show more 2026-04-26 08:00:23,738 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235 2026-04-26 12:01:23,409 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235 2026-04-26 18:01:21,152 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235 2026-04-26 21:01:18,181 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235 2026-04-27 00:01:28,609 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-25 20:34:58 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 16:34:51.512137 2026] [security2:error] [pid 10595:tid 10595] [client 2001:67c:289c:2::235:16726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bayareamustangs.com"] [uri "/wp-config.phpn"] [unique_id "ae0la4HKTOLY0w83b_VsxgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-23 20:29:47 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 16:29:41.734057 2026] [security2:error] [pid 24199:tid 24199] [client 2001:67c:289c:2::235:2844] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "freemanfoundationcle.org"] [uri "/wp-config.phpnew"] [unique_id "aeqBNZIXNqZOwbv07zA70AAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-18 18:48:22 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se) ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 18 14:48:17.400264 2026] [security2:error] [pid 3378399:tid 3378399] [client 2001:67c:289c:2::235:17468] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "medusakenya.com"] [uri "/wp-config.phpn"] [unique_id "aePR8VQjFGkW79lppiFyhAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 148 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 209.141.51.90

🇺🇸 136.57.105.135

🇻🇳 27.65.151.121

🇨🇳 219.157.67.55

🇹🇭 203.154.158.195

🇧🇩 114.130.156.251

🇺🇸 91.230.168.11

🇺🇸 85.254.65.103

🇮🇳 66.116.225.6

🇮🇳 35.200.194.171

🇧🇷 35.199.100.243

🇺🇸 34.73.6.44

🇬🇧 213.166.84.37

🇺🇸 198.98.54.3

🇬🇧 194.50.235.141

🇲🇽 187.216.224.85

🇮🇳 182.95.106.102

🇨🇳 116.230.222.67

🇹🇼 110.25.110.135

🇨🇳 94.231.206.9