JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2001:67c:289c:4::80

2001:67c:289c:4::80 was found in our database!

This IP was reported 154 times. Confidence of Abuse is 29%: ?

29%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Foreningen for digitala fri- och rattigheter
Usage Type	Fixed Line ISP
ASN	AS198093
Hostname(s)	tor-exit-read-me.dfri.se
Domain Name	dfri.net
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2001:67c:289c:4::80

Whois 2001:67c:289c:4::80

IP Abuse Reports for 2001:67c:289c:4::80:

This IP address has been reported a total of 154 times from 18 distinct sources. 2001:67c:289c:4::80 was first reported on November 26th 2022, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-06 10:31:33 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 06:31:19.285483 2026] [security2:error] [pid 8102:tid 8102] [client 2001:67c:289c:4::80:16118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.kennedysplace.com"] [uri "/.git/config"] [unique_id "aiP29-daxFJxrdQ7JPDaQAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-05 09:36:30 (4 days ago)	Blocked by UFW (TCP on 8333) Source port: 41746 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 41746 Packet length: 80 This report (for 2001:067c:289c:0004:0000:0000:0000:0080) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇨🇦 1gz	2026-05-30 09:56:40 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from T1. Action taken: CHALLENGE Protocol: HTTP/2 (GET met ... show more Triggered Cloudflare WAF (firewallCustom) from T1. Action taken: CHALLENGE Protocol: HTTP/2 (GET method) Endpoint: /auth/verify/Q5GcEyUTZCDM9KFtHj1scspY7EFLaPjx UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-05-09 12:44:50 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 08:44:42.760111 2026] [security2:error] [pid 7104:tid 7104] [client 2001:67c:289c:4::80:13692] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|energycapitalinvestments.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "energycapitalinvestments.com"] [uri "/ments_com.sql"] [unique_id "af8sOl2c1UkmETNvIJkvpAAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-08 16:13:23 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 12:13:12.901942 2026] [security2:error] [pid 9479:tid 9479] [client 2001:67c:289c:4::80:26540] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|doctorspainmanagement.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "doctorspainmanagement.com"] [uri "/ement_com.sql"] [unique_id "af4LmAiD-gVIY4l9dBnCnQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-08 13:06:13 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 28584 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 28584 Packet length: 80 This report (for 2001:067c:289c:0004:0000:0000:0000:0080) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-05-06 01:47:29 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 61856 Packet length: 80 This report (for 2001:067c:289c:0 ... show more Blocked by UFW (TCP on 8333) Source port: 61856 Packet length: 80 This report (for 2001:067c:289c:0004:0000:0000:0000:0080) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-04-26 21:01:30 (1 month ago)	2026-04-26 08:00:23,997 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:4::80 2026-0 ... show more 2026-04-26 08:00:23,997 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:4::80 2026-04-26 12:01:23,572 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:4::80 2026-04-26 18:01:21,310 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:4::80 2026-04-26 21:01:18,342 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:4::80 2026-04-27 00:01:29,597 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:4::80 show less	Brute-Force
🇩🇪 4server	2026-04-26 04:45:26 (1 month ago)	[SunApr2606:45:21.8789712026][security2:error][pid1633765:tid1634052][client2001:67c:289c:4::80:0]Mo ... show more [SunApr2606:45:21.8789712026][security2:error][pid1633765:tid1634052][client2001:67c:289c:4::80:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"allegraravizza.it\"][uri\"/bck.sql\"][unique_id\"ae2YYTSUECaP_mVy_IM2CgAAAcg\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-04-20 08:11:22 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 20 04:11:13.824219 2026] [security2:error] [pid 21833:tid 21845] [client 2001:67c:289c:4::80:58672] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|batonrougegazette.com\|F\|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "batonrougegazette.com"] [uri "/config.backup"] [unique_id "aeXfoVa16Zcr1UL8ONAfKAAAAMg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-18 04:40:16 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 18 00:40:00.404367 2026] [security2:error] [pid 4092520:tid 4092520] [client 2001:67c:289c:4::80:38076] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "local639.com"] [uri "/wp-config.phpe"] [unique_id "aeMLINIsw5GA0z6FbGNlZwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-04-16 14:24:21 (1 month ago)	[ThuApr1616:24:17.3211922026][security2:error][pid1492463:tid1492465][client2001:67c:289c:4::80:0]Mo ... show more [ThuApr1616:24:17.3211922026][security2:error][pid1492463:tid1492465][client2001:67c:289c:4::80:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"\^/wp-content/plugins/[\^/] /$readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt$\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"381\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"urbani.ch\"][uri\"/wp-content/plugins/simple-link-directory/readme.txt\"][unique_id\"aeDxEZZ-sOlQqM5NTwrS3QAAAQA\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-13 03:52:46 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 12 23:52:38.445310 2026] [security2:error] [pid 4037543:tid 4037543] [client 2001:67c:289c:4::80:37618] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "honweneedthis.com"] [uri "/wp-config.txt"] [unique_id "adxohuVX-IrkFpI26efmaAAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-22 18:13:39 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210730) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 14:13:33.544186 2026] [security2:error] [pid 20074:tid 20074] [client 2001:67c:289c:4::80:49448] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|rebelhollowfarm.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rebelhollowfarm.com"] [uri "/.sql"] [unique_id "acAxTTWXGExZl4wamwx9oQAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-22 14:20:57 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): ... show more (mod_security) mod_security (id:210492) triggered by 2001:67c:289c:4::80 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 10:20:49.832007 2026] [security2:error] [pid 15574:tid 15574] [client 2001:67c:289c:4::80:29154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.samuelpaley.com"] [uri "/.git/config"] [unique_id "ab_6wWt7GBDX8YmfETJ1yQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 154 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 182.95.185.14

🇧🇪 34.78.115.170

🇺🇸 216.180.246.205

🇭🇰 199.45.154.121

🇩🇪 167.94.145.29

🇲🇳 103.168.34.81

🇸🇰 80.87.218.38

🇬🇧 35.203.210.189

🇬🇧 217.146.80.103

🇺🇸 216.25.89.134

🇩🇪 194.88.98.89

🇬🇧 188.240.59.3

🇬🇧 185.216.145.171

🇧🇪 128.90.145.17

🇨🇳 116.179.32.214

🇧🇬 78.128.114.102

🇩🇪 69.5.169.117

🇩🇪 69.5.169.115

🇩🇪 69.5.169.94

🇸🇬 54.255.165.46