JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2602:80d:1005::12

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

72% Elevated

366 reports

75 reporters · latest 1 day ago

ISP: Censys, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS398705
Hostname(s): scanner-202.fr7.censys-scanner.com
Domain Name: censys.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

366 from 75 distinct reporters

First reported

May 4th 2024

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇹🇷 Turkey 34 🇳🇱 Netherlands 26 🇩🇪 Germany 25

Most common categories Web App Attack 102 Hacking 46 Bad Web Bot 39 Port Scan 26 Brute-Force 23

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-09-22 21:47:01 UTC · (1 month ago)	[TueSep2223:46:56.7627642026][security2:error][pid3919281:tid3919357][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [TueSep2223:46:56.7627642026][security2:error][pid3919281:tid3919357][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403\(phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"mail.hosting-e-domini.com\"][uri\"/\"][unique_id\"arL3UIY8Z0EBYALDc9erWQAAAMs\"] show less	Hacking Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-22 01:32:50 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-09-20 05:35:36 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇨🇭 4server	2026-09-20 03:00:59 UTC · (1 month ago)	[SunSep2005:00:56.0500452026][security2:error][pid4051548:tid4052111][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [SunSep2005:00:56.0500452026][security2:error][pid4051548:tid4052111][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403\(phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"www.swiss-web-hosting-ch.hostingedominio.net\"][uri\"/\"][unique_id\"aq9MaPED3m507_8yVdO7eQAAAMo\"] show less	Hacking Web App Attack
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-09-19 20:30:46 UTC · (1 month ago)	[Sat Sep 19 06:07:26.252058 2026] [authz_core:error] [pid 175322:tid 140602431747648] [client 2602:80d:1005::12:43366] AH01630: client denied by server configuration: /var/www/public_html/lists/ [Sat Sep 19 06:07:26.255844 2026] [authz_core:error] [p ... show more [Sat Sep 19 06:07:26.252058 2026] [authz_core:error] [pid 175322:tid 140602431747648] [client 2602:80d:1005::12:43366] AH01630: client denied by server configuration: /var/www/public_html/lists/ [Sat Sep 19 06:07:26.255844 2026] [authz_core:error] [pid 175322:tid 140602431747648] [client 2602:80d:1005::12:43366] AH01630: client denied by server configuration: /var/www/public_rsrc/assets/RMBS-Server-Error.html [Sat Sep 19 14:30:45.833798 2026] [authz_core:error] [pid 175308:tid 140601819375168] [client 2602:80d:1005::12:53686] AH01630: client denied by server configuration: /var/www/horde/ ... show less	Bad Web Bot
🇳🇴 noteng.no	2026-09-18 12:32:07 UTC · (1 month ago)	2602:80d:1005::12 - - [18/Sep/2026:14:32:01 +0200] "GET / HTTP/1.1" 400 150 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1005::12 - - [18/Sep/2026:14:32:01 +0200] "PRI * HTTP/2.0" 400 150 "-" "-" 2602:80d:1005 ... show more 2602:80d:1005::12 - - [18/Sep/2026:14:32:01 +0200] "GET / HTTP/1.1" 400 150 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1005::12 - - [18/Sep/2026:14:32:01 +0200] "PRI * HTTP/2.0" 400 150 "-" "-" 2602:80d:1005::12 - - [18/Sep/2026:14:32:06 +0200] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\x80\xA9\xB1T#\x1D\xC9\xEE\xB7k'0$1\xEC-O\x81\x0E\x1A,J\xAA\x83? \xB5[*ES\xBA 6\x9Dl\xBCyXR\xB6\xFAE\x1F\x9C\x87\xBB\x99\x89o\xDB\x92\xFEj$\x8F_v\x01\xD1h\x05\xD2Pm\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-" ... show less	Hacking Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-18 07:33:37 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 4server	2026-09-17 18:55:37 UTC · (1 month ago)	[ThuSep1720:55:31.3658962026][security2:error][pid2572330:tid2572391][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [ThuSep1720:55:31.3658962026][security2:error][pid2572330:tid2572391][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403\(phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqw3o-5e9S1sDF53BhesuAAAAcM\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 Sockets-AR	2026-09-17 18:45:28 UTC · (1 month ago)	CrowdSec: malicious bot / scanner detected (crowdsecurity/http-bad-user-agent) at 2026-09-17T18:45:27.515Z	Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-17 04:12:00 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 4server	2026-09-16 21:21:43 UTC · (1 month ago)	[WedSep1623:21:38.5851602026][security2:error][pid1248181:tid1248280][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [WedSep1623:21:38.5851602026][security2:error][pid1248181:tid1248280][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403\(phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqsIYhzWUiFZQWMJWUtT6AAAAYY\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 4server	2026-09-16 20:29:59 UTC · (1 month ago)	[WedSep1622:29:54.8373932026][security2:error][pid3406718:tid3406790][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\ ... show more [WedSep1622:29:54.8373932026][security2:error][pid3406718:tid3406790][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403\(phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a02:29b8:dc01:545::625:de4f\"][uri\"/\"][unique_id\"aqr8QqVhtdM-YJKOfnre3AAAAMs\"] show less	Hacking Web App Attack
🇨🇭 4server	2026-09-15 09:05:57 UTC · (1 month ago)	[TueSep1511:05:53.4738372026][security2:error][pid297948:tid298099][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\ ... show more [TueSep1511:05:53.4738372026][security2:error][pid297948:tid298099][client2602:80d:1005::12:0]ModSecurity:Accessdeniedwithcode403\(phase2$.Patternmatch\"$\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a02:29b8:dc01:545::625:de4f\"][uri\"/\"][unique_id\"aqkKcUkiU5528BU9NgZtrwAAAEI\"] show less	Hacking Web App Attack
🇦🇺 Starburst SysOp Team	2026-09-14 04:15:00 UTC · (1 month ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-syd2-4)	Hacking Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-09-14 03:16:40 UTC · (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot

Showing 91 to 105 of 366 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 205.210.31.83

🇳🇱 193.47.62.96

🇮🇩 160.25.35.204

🇨🇳 106.75.169.149

🇩🇪 91.210.146.147

🇩🇪 88.218.47.155

🇺🇸 66.132.224.227

🇩🇪 64.89.163.158

🇩🇪 51.89.38.137

🇺🇸 40.119.28.96

🇨🇳 36.134.69.15

🇰🇷 218.238.5.110

🇳🇱 204.76.203.38

🇩🇪 194.88.98.87

🇦🇷 181.24.28.14

🇺🇸 143.246.215.27

🇮🇳 117.247.23.131

🇳🇱 109.160.32.178

🇬🇧 34.153.183.105

🇺🇸 24.44.46.151