JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2602:80d:1007::5c

2602:80d:1007::5c was found in our database!

This IP was reported 235 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Domain Name	censys.io
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2602:80d:1007::5c

Whois 2602:80d:1007::5c

IP Abuse Reports for 2602:80d:1007::5c:

This IP address has been reported a total of 235 times from 60 distinct sources. 2602:80d:1007::5c was first reported on March 21st 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 london2038.com	2026-09-02 15:07:15 (3 hours ago)	Probing for exploits 2602:80d:1007::5c - - [02/Sep/2026:17:06:09 +0200] "GET / HTTP/1.1" 422 0 "-" " ... show more Probing for exploits 2602:80d:1007::5c - - [02/Sep/2026:17:06:09 +0200] "GET / HTTP/1.1" 422 0 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1007::5c - - [02/Sep/2026:17:07:12 +0200] "GET /security.txt HTTP/1.1" 422 0 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" show less	Hacking Web App Attack
🇯🇵 gomasy	2026-09-02 13:32:34 (5 hours ago)	_:80 2602:80d:1007::5c - - [02/Sep/2026:22:32:33 +0900] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x0 ... show more _:80 2602:80d:1007::5c - - [02/Sep/2026:22:32:33 +0900] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xE5\xBA+\xC3\xEDZi_\x00U\x00\xA0\x06\xD2\xCCxfz\xEFH\xE9\x8C\x16\xA8\x7F-\x94\xE2\xB8<\xD6\x05 \xA5\xBB\x95\xBAh\x04TU7\xB5:V\x08\xD4\xE8g=\xD5\xAB\x9F\xBA\xEB\x15\xDFU\xC4\xFC\x97\x09\xD9\xE6\x05\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 500 170 "-" "-" ... show less	Web App Attack
🇺🇸 VanKoh	2026-09-01 08:52:15 (1 day ago)	2602:80d:1007::5c - - [01/Sep/2026:02:51:27 -0600] "GET / HTTP/1.1" 301 5 "-" "Mozilla/5.0 (compatib ... show more 2602:80d:1007::5c - - [01/Sep/2026:02:51:27 -0600] "GET / HTTP/1.1" 301 5 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1007::5c - - [01/Sep/2026:02:52:09 -0600] "GET /sitemap.xml HTTP/1.1" 200 237 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1007::5c - - [01/Sep/2026:02:52:15 -0600] "GET /favicon.ico HTTP/1.1" 302 5 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" ... show less	Port Scan Web App Attack
🇯🇵 gomasy	2026-08-31 20:44:00 (1 day ago)	_:80 2602:80d:1007::5c - - [01/Sep/2026:05:44:00 +0900] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x0 ... show more _:80 2602:80d:1007::5c - - [01/Sep/2026:05:44:00 +0900] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03{HOW\xEEnr\xBF\x11\x9A\xD5\xA6bH\xB4d\xCF\xA0\xB3\x10\xED\x96\xB5\xD7s`\xC3\xA0\x90g\x9C\x09 7\xBA@7\x94y\x80\x13\xB4\xD2w\xFD\x10*k\x5C\xAD\xE1\x9A\xFB\xB7?zR)C\x13\x85!S\xBC\xF8\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 500 170 "-" "-" ... show less	Web App Attack
🇩🇪 4server	2026-08-31 17:39:46 (2 days ago)	[MonAug3119:39:42.7166282026][security2:error][pid3006017:tid3006111][client2602:80d:1007::5c:0]ModS ... show more [MonAug3119:39:42.7166282026][security2:error][pid3006017:tid3006111][client2602:80d:1007::5c:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"apW8XiV5_nCRh9ewlHSaggAAAMk\"] show less	Port Scan Brute-Force Web App Attack
🇵🇱 mscode.pl	2026-08-29 20:32:36 (3 days ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 398324 (Censys, Inc.) Pr ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 398324 (Censys, Inc.) Protocol: HTTP/1.1 (GET method) Zone: r2.selify.io Endpoint: / UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) show less	Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-08-29 10:00:53 (4 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-14)	Hacking Bad Web Bot
Anonymous	2026-08-29 08:52:02 (4 days ago)	2602:80d:1007::5c - - [29/Aug/2026:08:51:04 +0000] "PRI * HTTP/2.0" 400 166 "-" "-" 2602:80d:1007::5 ... show more 2602:80d:1007::5c - - [29/Aug/2026:08:51:04 +0000] "PRI * HTTP/2.0" 400 166 "-" "-" 2602:80d:1007::5c - - [29/Aug/2026:08:51:06 +0000] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xC9H\x11J\x15l]@\x9D\x91\xEC\xEDs'\xCC-7i\x9B\xF7C^g\x87\x98W\xA8\xCDW\xF4T\xE6 \xE3\xE7H\xD7u\x89\x81\xC7\xABx\xC9\xA8\xFB\x0B\xC9" 400 166 "-" "-" 2602:80d:1007::5c - - [29/Aug/2026:08:52:01 +0000] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x038\xB92qLu\x08\x14\x0F\x15\xE0\xABq\xF8\xC3j\x07\xF4\x80\x11\xCDN5/\xD02\xFBN\xC5ni\xB3 R\xCA\x08\xD4//\x95\x96}\x0F\xCF\xD5W\x81M\xDA\x9B4\x83\x92>Y\xDB\x89/\x97\x8B\x80\xFE\x1B\xEC:\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 166 "-" "-" ... show less	Brute-Force
Anonymous	2026-08-28 06:23:21 (5 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-08-27 16:32:29 (6 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-17)	Hacking Bad Web Bot
🇺🇸 factor1	2026-08-25 04:36:27 (1 week ago)	CrowdSec at churndash Reports Abuse	Web App Attack
🇩🇪 LRob	2026-08-24 17:31:51 (1 week ago)	Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5 ... show more Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) \| path: / (+1 more) \| 2026-08-24 17:31 UTC show less	Bad Web Bot
🇩🇪 LRob	2026-08-23 12:58:50 (1 week ago)	Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5 ... show more Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) \| path: / (+1 more) \| 2026-08-23 12:58 UTC show less	Bad Web Bot
Anonymous	2026-08-23 02:54:43 (1 week ago)	Fail2Ban triggered	Web App Attack
🇩🇪 4server	2026-08-22 22:18:02 (1 week ago)	[SunAug2300:18:00.1163882026][security2:error][pid3008400:tid3008415][client2602:80d:1007::5c:0]ModS ... show more [SunAug2300:18:00.1163882026][security2:error][pid3008400:tid3008415][client2602:80d:1007::5c:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aoogGO6Z9cyW3RWuOPIPMAAAAAQ\"] show less	Port Scan Brute-Force Web App Attack

Showing 1 to 15 of 235 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 223.123.65.54

🇺🇸 216.73.161.96

🇮🇳 183.82.145.160

🇩🇪 142.93.175.65

🇺🇸 70.166.140.52

🇺🇸 66.132.195.66

🇫🇮 65.109.178.234

🇳🇱 160.119.66.51

🇺🇸 136.144.43.10

🇻🇳 103.9.204.209

🇸🇬 101.47.19.182

🇮🇷 78.109.200.147

🇳🇱 45.156.87.93

🇬🇧 195.96.139.31

🇫🇮 147.185.133.230

🇺🇸 91.193.232.168

🇺🇸 45.79.177.245

🇨🇱 201.189.43.120

🇹🇼 198.235.24.44

🇺🇦 195.211.63.156