JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2001:67c:289c:2::38

Neutral Activity IPv6 SLAAC Note

Abuse Confidence Score

0% Low Risk

106 reports

16 reporters · latest 1 month ago

ISP: Foreningen for digitala fri- och rattigheter
Usage Type: Fixed Line ISP
ASN: AS198093
Domain Name: dfri.net
Country: 🇸🇪 Sweden
City: Stockholm, Stockholm

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

106 from 16 distinct reporters

First reported

July 27th 2025

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 1

Most common categories Brute-Force 1 Bad Web Bot 1 Web App Attack 1

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-07 10:35:34 UTC · (1 month ago)	(mod_security) mod_security (id:210831) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 06:35:25.048430 2026] [security2:error] [pid 18077:tid 18077] [ ... show more (mod_security) mod_security (id:210831) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 06:35:25.048430 2026] [security2:error] [pid 18077:tid 18077] [client 2001:67c:289c:2::38:56294] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.newcangroup.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.newcangroup.com"] [uri "/robots.txt"] [unique_id "asYgbYXx9FhXI7-WgSp5lQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-09-08 03:20:09 UTC · (2 months ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FD-IX	2026-09-08 02:59:52 UTC · (2 months ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇩🇪 4server	2026-07-31 17:05:51 UTC · (3 months ago)	[FriJul3119:05:46.6884552026][security2:error][pid430272:tid430291][client2001:67c:289c:2::38:0]ModSecurity:Accessdeniedwithcode403$phase2$.OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-9 ... show more [FriJul3119:05:46.6884552026][security2:error][pid430272:tid430291][client2001:67c:289c:2::38:0]ModSecurity:Accessdeniedwithcode403$phase2$.OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded$TotalScore:5$\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"ipv6.jrtradeinnovation.ch\"][uri\"/\"][unique_id\"amzV6iHWHbqel2Q4JHe7UQAAAAY\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 xmission.com	2026-07-29 00:20:47 UTC · (3 months ago)	Blocked by UFW (TCP on 9999) Source port: 39092 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0038) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan Ping of Death
🇺🇸 xmission.com	2026-07-25 12:42:24 UTC · (3 months ago)	Blocked by UFW (TCP on 8333) Source port: 33366 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0038) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇺🇸 xmission.com	2026-07-13 08:28:54 UTC · (3 months ago)	Blocked by UFW (TCP on 9999) Source port: 45662 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0038) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan Ping of Death
🇺🇸 xmission.com	2026-07-01 05:39:41 UTC · (4 months ago)	Blocked by UFW (TCP on 8333) Source port: 52294 Packet length: 80 This report (for 2001:067c:289c:0002:0000:0000:0000:0038) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇩🇪 4server	2026-06-14 07:51:00 UTC · (4 months ago)	[SunJun1409:50:55.5451862026][security2:error][pid2397636:tid2397668][client2001:67c:289c:2::38:0]ModSecurity:Accessdeniedwithcode403$phase2$.OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST ... show more [SunJun1409:50:55.5451862026][security2:error][pid2397636:tid2397668][client2001:67c:289c:2::38:0]ModSecurity:Accessdeniedwithcode403$phase2$.OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded$TotalScore:5$\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"ipv6.feldenkraistherapy.ch\"][uri\"/.DS_Store\"][unique_id\"ai5dX1JCBUvnhLQgbZW1SQAAABU\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 22:27:08 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:27:02.934023 2026] [security2:error] [pid 23151:tid 23151] [ ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:27:02.934023 2026] [security2:error] [pid 23151:tid 23151] [client 2001:67c:289c:2::38:58604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.tomhatcher.us"] [uri "/.git/config"] [unique_id "ais2NvwafkhupAXpJ4153QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 14:03:47 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 10:03:39.190664 2026] [security2:error] [pid 10775:tid 10775] [ ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 10:03:39.190664 2026] [security2:error] [pid 10775:tid 10775] [client 2001:67c:289c:2::38:32796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.lamporix.com"] [uri "/.git/config"] [unique_id "aiLXO0iNaEQ0hy_UmUVDiQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-30 04:39:06 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 00:38:57.900113 2026] [security2:error] [pid 29513:tid 29513] [ ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 00:38:57.900113 2026] [security2:error] [pid 29513:tid 29513] [client 2001:67c:289c:2::38:51204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.barkdull.org"] [uri "/.git/config"] [unique_id "afLc4cnwya6awHLkaJMYaQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-26 21:01:27 UTC · (6 months ago)	2026-04-26 08:00:23,338 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 2026-04-26 12:01:23,171 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 2026-04-26 18:01:20,915 fail2ban.actions [7718]: NOTICE ... show more 2026-04-26 08:00:23,338 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 2026-04-26 12:01:23,171 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 2026-04-26 18:01:20,915 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 2026-04-26 21:01:17,941 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 2026-04-27 00:01:27,107 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::38 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-26 15:31:30 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:31:20.853028 2026] [security2:error] [pid 20223:tid 20229] [ ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:31:20.853028 2026] [security2:error] [pid 20223:tid 20229] [client 2001:67c:289c:2::38:55396] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.adprospb.com"] [uri "/.git/config"] [unique_id "ae4vyGbBEl4m3zKjla7gowAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-25 20:34:14 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 16:34:04.403193 2026] [security2:error] [pid 9753:tid 9753] [cl ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::38 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 16:34:04.403193 2026] [security2:error] [pid 9753:tid 9753] [client 2001:67c:289c:2::38:33102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bayareamustangs.com"] [uri "/wp-config.php~~"] [unique_id "ae0lPGp1d726pJWVN6xtQQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 106 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇹🇼 2400:cb00:80:1000:89ef:e36b:6473:40a4

🇺🇸 206.81.7.252

🇹🇷 194.1.184.238

🇹🇷 194.1.184.234

🇺🇸 192.153.76.37

🇳🇱 188.166.25.133

🇫🇷 185.194.178.102

🇺🇸 173.239.198.157

🇨🇳 82.156.59.254

🇫🇷 13.140.142.162

🇷🇴 2.57.122.209

🇷🇴 2.57.122.168

🇺🇸 199.165.159.169

🇭🇰 194.187.178.197

🇹🇷 194.1.184.232

🇺🇸 185.214.242.220

🇺🇸 185.214.242.219

🇺🇸 162.216.150.59

🇫🇮 147.185.133.202

🇨🇳 124.67.120.106