JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 240e:108:4ba1:fffe::2

240e:108:4ba1:fffe::2 was found in our database!

This IP was reported 92 times. Confidence of Abuse is 53%: ?

53%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Chinatelecom IPv6 address for network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Chengdu, Sichuan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 240e:108:4ba1:fffe::2

Whois 240e:108:4ba1:fffe::2

IP Abuse Reports for 240e:108:4ba1:fffe::2:

This IP address has been reported a total of 92 times from 51 distinct sources. 240e:108:4ba1:fffe::2 was first reported on June 7th 2024, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 gomasy	2026-09-11 00:38:56 (17 hours ago)	2026-09-11T09:38:55.575708+09:00 ssv02 postfix/submission/smtpd[3428030]: improper command pipelinin ... show more 2026-09-11T09:38:55.575708+09:00 ssv02 postfix/submission/smtpd[3428030]: improper command pipelining after CONNECT from unknown[240e:108:4ba1:fffe::2]: EHLO\r\n ... show less	Brute-Force
🇺🇸 en0	2026-09-10 19:32:12 (23 hours ago)	240e:0108:4ba1:fffe:0000:0000:0000:0002 was recorded 3 times by 1 hosts attempting to connect to 2 u ... show more 240e:0108:4ba1:fffe:0000:0000:0000:0002 was recorded 3 times by 1 hosts attempting to connect to 2 unique ports. Incident counter (4h, 24h, all-time): 3, 3, 3 show less	Port Scan
Anonymous	2026-09-05 16:18:54 (6 days ago)	Unauthorized connection to SIP port 5060	Fraud VoIP Port Scan
🇦🇺 aranguren.org	2026-09-03 06:04:25 (1 week ago)	240e:108:4ba1:fffe::2 - - [03/Sep/2026:16:04:23 +1000] "POST /sdk HTTP/1.1" 400 918 "-" "Mozilla/5.0 ... show more 240e:108:4ba1:fffe::2 - - [03/Sep/2026:16:04:23 +1000] "POST /sdk HTTP/1.1" 400 918 "-" "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36" 240e:108:4ba1:fffe::2 - - [03/Sep/2026:16:04:23 +1000] "GET /nmaplowercheck1788415463 HTTP/1.1" 400 918 "-" "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36" 240e:108:4ba1:fffe::2 - - [03/Sep/2026:16:04:23 +1000] "HEAD / HTTP/1.1" 400 - "-" "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36" 240e:108:4ba1:fffe::2 - - [03/Sep/2026:16:04:24 +1000] "GET / HTTP/1.1" 400 918 "-" "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36" 240e:108:4ba1:fffe::2 - - [03/Sep/2026:16:04:24 +1000] "GET /HNAP1 HTTP/1.1" 400 918 "-" "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36" 240e:108:4ba1 ... show less	Bad Web Bot
🇺🇸 xmission.com	2026-08-31 16:06:34 (1 week ago)	Blocked by UFW (TCP on 32768) Source port: 48219 Packet length: 64 This report (for 240e:0108:4ba1: ... show more Blocked by UFW (TCP on 32768) Source port: 48219 Packet length: 64 This report (for 240e:0108:4ba1:fffe:0000:0000:0000:0002) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 LRob	2026-08-28 08:34:57 (2 weeks ago)	SMTP abuse: repeated rejected delivery attempts (spam or recipient guessing) \| 2026-08-28 08:34 UTC	Email Spam
🇩🇰 powerhostingdk	2026-08-27 06:40:54 (2 weeks ago)	[mailserver] CrowdSec detected crowdsecurity/postfix-non-smtp-command (1 events). Automated abuse re ... show more [mailserver] CrowdSec detected crowdsecurity/postfix-non-smtp-command (1 events). Automated abuse report. show less	Brute-Force
🇺🇸 xmission.com	2026-08-19 13:34:59 (3 weeks ago)	Blocked by UFW (TCP on 32768) Source port: 56001 Packet length: 64 This report (for 240e:0108:4ba1: ... show more Blocked by UFW (TCP on 32768) Source port: 56001 Packet length: 64 This report (for 240e:0108:4ba1:fffe:0000:0000:0000:0002) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇵🇱 nfsec.pl	2026-08-15 09:38:13 (3 weeks ago)	2026-08-15T09:38:13.009561+00:00 stardust postfix/smtpd[4148322]: improper command pipelining after ... show more 2026-08-15T09:38:13.009561+00:00 stardust postfix/smtpd[4148322]: improper command pipelining after CONNECT from unknown[240e:108:4ba1:fffe::2]: HELP\r\n ... show less	Email Spam Open Proxy
🇩🇪 becker-software.de	2026-08-15 00:35:42 (3 weeks ago)	2026-08-15T00:35:39.880147+00:00 becker-software kernel: [UFW BLOCK] IN=eth0 OUT= MAC=bc:24:22:07:02 ... show more 2026-08-15T00:35:39.880147+00:00 becker-software kernel: [UFW BLOCK] IN=eth0 OUT= MAC=bc:24:22:07:02:ee:98:5d:82:29:8f:43:86:dd SRC=240e:0108:4ba1:fffe:0000:0000:0000:0002 DST=2a14:07c0:7000:0500:0077:0090:0016:0003 LEN=64 TC=0 HOPLIMIT=232 FLOWLBL=0 PROTO=TCP SPT=63479 DPT=1723 WINDOW=1024 RES=0x00 SYN URGP=0 2026-08-15T00:35:39.894513+00:00 becker-software kernel: [UFW BLOCK] IN=eth0 OUT= MAC=bc:24:22:07:02:ee:98:5d:82:29:8f:43:86:dd SRC=240e:0108:4ba1:fffe:0000:0000:0000:0002 DST=2a14:07c0:7000:0500:0077:0090:0016:0003 LEN=64 TC=0 HOPLIMIT=232 FLOWLBL=0 PROTO=TCP SPT=63479 DPT=554 WINDOW=1024 RES=0x00 SYN URGP=0 2026-08-15T00:35:39.895129+00:00 becker-software kernel: [UFW BLOCK] IN=eth0 OUT= MAC=bc:24:22:07:02:ee:98:5d:82:29:8f:43:86:dd SRC=240e:0108:4ba1:fffe:0000:0000:0000:0002 DST=2a14:07c0:7000:0500:0077:0090:0016:0003 LEN=64 TC=0 HOPLIMIT=232 FLOWLBL=0 PROTO=TCP SPT=63479 DPT=25 WINDOW=1024 RES=0x00 SYN URGP=0 2026-08-15T00:35:39.900119+00:00 becker-software kernel: [UFW BL ... show less	Port Scan
🇩🇰 powerhostingdk	2026-08-06 19:34:50 (1 month ago)	[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.	Email Spam Brute-Force
🇺🇸 cwytech	2026-07-30 14:50:36 (1 month ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-geofence-sus.	Bad Web Bot Web App Attack
🇩🇪 LRob	2026-07-28 20:13:33 (1 month ago)	CrowdSec: crowdsecurity/http-bad-user-agent \| req: / \| UA: \x5C\x22Mozilla/5.0(WindowsNT10.0;Win64;x ... show more CrowdSec: crowdsecurity/http-bad-user-agent \| req: / \| UA: \x5C\x22Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML show less	Bad Web Bot
🇩🇪 tinect	2026-07-24 02:38:18 (1 month ago)	Gets ban for 4h for triggering crowdsecurity/postfix-spam at root1.	Web App Attack
🇨🇭 SOC [GOLINE SA]	2026-07-23 18:40:21 (1 month ago)	IDS Alert: IDS High-Severity Alert === ATTACK === Signature: IDS High-Severity Alert \| SID: N/A \| Se ... show more IDS Alert: IDS High-Severity Alert === ATTACK === Signature: IDS High-Severity Alert \| SID: N/A \| Severity: 1-2 \| Category: Security Threat === SOURCE === IP: 240e:108:4ba1:fffe::2 (IPv6) \| Port: N/A \| Country: China \| ISP: CT-IPV6-NETWORK-ADDRESS \| rDNS: None === TARGET === Host: goline.ch \| IP: goline.ch \| Port: multiple \| Protocol: TCP/UDP \| App: N/A === RESPONSE === Time: 2026-07-23 20:40:17 \| Action: Blocked show less	Port Scan Hacking Bad Web Bot

Showing 1 to 15 of 92 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 62.60.130.242

🇳🇱 45.156.128.132

🇰🇷 222.111.148.83

🇧🇷 186.215.44.225

🇸🇬 178.128.106.254

🇺🇸 156.249.16.229

🇨🇦 148.170.129.74

🇰🇷 129.254.196.6

🇨🇿 109.164.88.124

🇺🇦 94.131.240.190

🇷🇺 88.147.152.237

🇸🇬 35.240.196.131

🇺🇸 35.231.112.249

🇺🇸 34.125.218.153

🇧🇦 213.91.82.212

🇳🇱 195.178.110.218

🇪🇨 181.198.51.126

🇮🇳 106.219.149.173

🇮🇩 103.144.126.82

🇷🇴 92.118.39.49