JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2602:80d:1003::1d

Activity Trending Down IPv6 SLAAC Note

Abuse Confidence Score

34% Elevated

268 reports

86 reporters · latest 1 month ago

ISP: Censys, Inc.
Usage Type: Commercial
ASN: Unknown
Hostname(s): scanner-201.hk2.censys-scanner.com
Domain Name: censys.com
Country: 🇺🇸 United States of America
City: Ann Arbor, Michigan

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

268 from 86 distinct reporters

First reported

April 28th 2024

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇩🇪 Germany 16 🇳🇱 Netherlands 11 🇨🇭 Switzerland 5

Most common categories Web App Attack 28 Bad Web Bot 21 Port Scan 10 Brute-Force 10 Hacking 5

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-09-26 16:47:17 UTC · (1 month ago)	[SatSep2618:47:13.0776782026][security2:error][pid2501265:tid2501537][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [SatSep2618:47:13.0776782026][security2:error][pid2501265:tid2501537][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"arf3EVYICjIhdNF2RQNYcQAAAQ4\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 Charlesiv	2026-09-25 22:01:00 UTC · (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from HK. Action taken: BLOCK ASN: 398722 (Censys, Inc.) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-25T21:00:20Z Ray ID: a40cf53248764a96 UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +ht ... show more Triggered Cloudflare WAF (firewallCustom) from HK. Action taken: BLOCK ASN: 398722 (Censys, Inc.) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-25T21:00:20Z Ray ID: a40cf53248764a96 UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) show less	Bad Web Bot
🇰🇷 doll.gl	2026-09-25 15:04:17 UTC · (1 month ago)	CrowdSec: Ip 2602:80d:1003::1d performed 'crowdsecurity/http-bad-user-agent' (2 events over 10.920862616s) at 2026-09-25 15:04:16.778112368 +0000 UTC (scenario: crowdsecurity/http-bad-user-agent)	Bad Web Bot
Anonymous	2026-09-25 11:51:04 UTC · (1 month ago)	Unauthorized SSH login attempts	Brute-Force SSH
🇩🇪 enjoyably	2026-09-23 18:25:11 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 TheDjRider	2026-09-22 12:20:07 UTC · (1 month ago)	CrowdSec detected Malicious web crawler or bad web bot. Scenario: crowdsecurity/http-bad-user-agent. Automatic ban triggered. Detection time (UTC): 2026-09-22T12:20:00.600472215Z. Context: http_status=200, http_status=302	Bad Web Bot Web App Attack
🇩🇪 4server	2026-09-21 06:27:46 UTC · (1 month ago)	[MonSep2108:27:41.8714952026][security2:error][pid3084936:tid3085047][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [MonSep2108:27:41.8714952026][security2:error][pid3084936:tid3085047][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"balso.autoeuro.lv\"][uri\"/\"][unique_id\"arDOXSFYgGgImVQzIL2NtAAAAM8\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 abenage	2026-09-20 13:04:34 UTC · (1 month ago)	2602:80d:1003::1d - - [20/Sep/2026:07:04:33 -0600] "x16x03x01x01x06x01x00x01x02x03x03:x7F@xACxE3TxDD2x0BxFEDxD2dgx11ExB0E_xE8_HxF1xEDxFCxD4NxBEx17Kx15A gBx1FxD7x8Ac_xBCU\|x7FxC5xB7xB7x19xEBxECHxDBx80xD2xE7x19xF5x7FxDAux1EF(x9Cx1Bx00&xCCxA8xCCxA9xC0/xC ... show more 2602:80d:1003::1d - - [20/Sep/2026:07:04:33 -0600] "x16x03x01x01x06x01x00x01x02x03x03:x7F@xACxE3TxDD2x0BxFEDxD2dgx11ExB0E_xE8_HxF1xEDxFCxD4NxBEx17Kx15A gBx1FxD7x8Ac_xBCU\|x7FxC5xB7xB7x19xEBxECHxDBx80xD2xE7x19xF5x7FxDAux1EF(x9Cx1Bx00&xCCxA8xCCxA9xC0/xC00xC0+xC0,xC0x13xC0x09xC0x14xC0" 400 166 "-" "-" show less	Port Scan Web App Attack
🇩🇪 filstal.org	2026-09-20 02:23:35 UTC · (1 month ago)	Bad bot activity detected (automated scraping/probing).	Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-19 18:18:02 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 4server	2026-09-17 06:08:23 UTC · (1 month ago)	[ThuSep1708:08:20.9513772026][security2:error][pid1752543:tid1752570][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [ThuSep1708:08:20.9513772026][security2:error][pid1752543:tid1752570][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"www.flyingberber.artisteer-italia.org\"][uri\"/\"][unique_id\"aquD1FItyoXCyxOnrpEM1wAAABA\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 4server	2026-09-17 01:38:56 UTC · (1 month ago)	[ThuSep1703:38:53.0865692026][security2:error][pid3780204:tid3780233][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [ThuSep1703:38:53.0865692026][security2:error][pid3780204:tid3780233][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a02:29b8:dc01:545::625:de4f\"][uri\"/\"][unique_id\"aqtErR2utD8Sf__c12KJFQAAABM\"] show less	Hacking Web App Attack
🇩🇪 4server	2026-09-16 05:42:12 UTC · (1 month ago)	[WedSep1607:42:06.0300552026][security2:error][pid113820:tid113922][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\ ... show more [WedSep1607:42:06.0300552026][security2:error][pid113820:tid113922][client2602:80d:1003::1d:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqosLg7BILs-7VGiax6cQgAAARA\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-14 05:40:17 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇸🇬 Starburst SysOp Team	2026-09-14 05:03:11 UTC · (1 month ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-sin2-2)	Hacking Bad Web Bot

Showing 16 to 30 of 268 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇷 210.206.95.162

🇮🇷 185.118.13.155

🇧🇷 177.66.223.217

🇫🇷 91.231.89.85

🇺🇸 91.230.168.180

🇺🇸 64.62.197.105

🇸🇬 47.128.27.124

🇺🇸 2604:a880:400:d1:0:5:5fbf:f001

🇦🇺 2602:f71d:200::20

🇩🇪 213.209.159.239

🇬🇧 193.163.125.205

🇨🇱 191.125.165.147

🇺🇸 172.59.99.111

🇨🇭 104.244.79.113

🇺🇸 104.207.38.250

🇳🇱 93.123.109.103

🇺🇸 91.230.168.182

🇺🇸 91.230.168.4

🇺🇸 67.205.183.195

🇺🇸 66.132.159.106