JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2602:80d:1004::25

Activity Trending Down IPv6 SLAAC Note

Abuse Confidence Score

35% Elevated

345 reports

84 reporters · latest 1 month ago

ISP: Censys, Inc.
Usage Type: Commercial
ASN: Unknown
Hostname(s): scanner-204.hk2.censys-scanner.com
Domain Name: censys.com
Country: 🇺🇸 United States of America
City: Ann Arbor, Michigan

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

345 from 84 distinct reporters

First reported

March 28th 2024

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇳🇱 Netherlands 20 🇩🇪 Germany 14 🇺🇸 United States of America 4

Most common categories Web App Attack 37 Bad Web Bot 27 Brute-Force 10 Port Scan 9 Hacking 3

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 enjoyably	2026-09-18 19:20:58 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇰 toolbit.online	2026-09-18 17:29:40 UTC · (1 month ago)	High-confidence automated scanner activity flagged by CrowdSec - 2 matching events. Classified as known-bad scanner user-agent (scenario "http-bad-user-agent", in our own server logs). Behavioural detection, auto-banned at the firewall.	Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-18 14:42:39 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-09-17 12:50:39 UTC · (1 month ago)	[Mon Sep 14 13:33:46.892409 2026] [authz_core:error] [pid 2248:tid 140601668372032] [client 2602:80d:1004::25:44994] AH01630: client denied by server configuration: /var/www/public_html/symposium/ [Mon Sep 14 13:33:46.894696 2026] [authz_core:error] ... show more [Mon Sep 14 13:33:46.892409 2026] [authz_core:error] [pid 2248:tid 140601668372032] [client 2602:80d:1004::25:44994] AH01630: client denied by server configuration: /var/www/public_html/symposium/ [Mon Sep 14 13:33:46.894696 2026] [authz_core:error] [pid 2248:tid 140601668372032] [client 2602:80d:1004::25:44994] AH01630: client denied by server configuration: /var/www/public_rsrc/assets/RMBS-Server-Error.html [Thu Sep 17 06:50:38.755097 2026] [authz_core:error] [pid 105359:tid 140602826008128] [client 2602:80d:1004::25:38278] AH01630: client denied by server configuration: /var/www/public_html/www/ ... show less	Bad Web Bot
🇩🇪 4server	2026-09-16 21:28:39 UTC · (1 month ago)	[WedSep1623:28:35.1932612026][security2:error][pid1251392:tid1251507][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [WedSep1623:28:35.1932612026][security2:error][pid1251392:tid1251507][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqsKA96YMl0u2lhr2Y_zVQAAAZc\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-16 11:31:29 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 4server	2026-09-16 02:40:15 UTC · (1 month ago)	[WedSep1604:40:10.6344082026][security2:error][pid4114639:tid4114685][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [WedSep1604:40:10.6344082026][security2:error][pid4114639:tid4114685][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"life-live.ch\"][uri\"/favicon.ico\"][unique_id\"aqoBikN9K8lxo_e7nprkoQAAAEk\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 4server	2026-09-15 09:51:06 UTC · (1 month ago)	[TueSep1511:51:00.7803472026][security2:error][pid3080557:tid3080653][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [TueSep1511:51:00.7803472026][security2:error][pid3080557:tid3080653][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqkVBH6ajUXedySyh8jAoAAAAMc\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-13 21:14:35 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-09-12 11:31:33 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-09-11 00:48:17 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 enjoyably	2026-09-10 05:35:11 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇫🇷 LRNP	2026-09-09 12:49:35 UTC · (1 month ago)	_:80 2602:80d:1004::25 - - [09/Sep/2026:12:49:34 +0000] "\x16\x03\x01\x01\x07\x01\x00\x01\x03\x03\x03\x14\x10\x92\xB3\x1AXt\xBC\xE2\x85\xED\x0B\x18\xB5\x8D\xDDA>\x83\x02\xBC\x1E\x18\xFDiE\x9C\xE3\xFA.m\x82 \x9E\|\x85^\xE8\xEAPo=\xDB=\xB7\xFA)Q\xD2M\xF ... show more _:80 2602:80d:1004::25 - - [09/Sep/2026:12:49:34 +0000] "\x16\x03\x01\x01\x07\x01\x00\x01\x03\x03\x03\x14\x10\x92\xB3\x1AXt\xBC\xE2\x85\xED\x0B\x18\xB5\x8D\xDDA>\x83\x02\xBC\x1E\x18\xFDiE\x9C\xE3\xFA.m\x82 \x9E\|\x85^\xE8\xEAPo=\xDB=\xB7\xFA)Q\xD2M\xF0H\xC4\x82\xB4\xD9\x5C\x00e-\x1E\xA2\x5C\xF8\xFA\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-" ... show less	Bad Web Bot Web App Attack
🇩🇪 4server	2026-09-09 10:03:32 UTC · (1 month ago)	[WedSep0912:03:30.2400092026][security2:error][pid2880246:tid2880268][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [WedSep0912:03:30.2400092026][security2:error][pid2880246:tid2880268][client2602:80d:1004::25:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"www.esengineering.ch\"][uri\"/\"][unique_id\"aqEu8iEKe_bReqFZGWDiNwAAAMY\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-09 08:18:48 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot

Showing 31 to 45 of 345 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 217.181.94.113

🇧🇩 202.91.42.75

🇩🇪 195.63.23.43

🇮🇹 176.113.107.97

🇲🇾 172.197.203.24

🇺🇸 142.111.40.39

🇮🇳 117.203.64.213

🇺🇸 104.165.192.134

🇳🇱 46.151.178.14

🇺🇸 45.147.233.251

🇺🇸 24.208.254.64

🇺🇸 216.180.246.240

🇺🇸 216.180.246.100

🇺🇸 216.180.246.52

🇸🇬 212.73.148.22

🇬🇧 193.163.125.97

🇸🇬 188.166.233.86

🇵🇱 172.69.155.8

🇨🇳 171.37.193.245

🇺🇸 166.1.252.237