JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2602:80d:1007::79

2602:80d:1007::79 was found in our database!

This IP was reported 60 times. Confidence of Abuse is 60%: ?

60%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Domain Name	censys.io
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2602:80d:1007::79

Whois 2602:80d:1007::79

IP Abuse Reports for 2602:80d:1007::79:

This IP address has been reported a total of 60 times from 22 distinct sources. 2602:80d:1007::79 was first reported on March 21st 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Starburst SysOp Team	2026-06-07 21:46:38 (5 hours ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-13)	Hacking Bad Web Bot
🇩🇪 ecs.ge	2026-06-07 14:47:47 (12 hours ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇦🇺 2000cn.com.au	2026-06-07 00:23:08 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇺🇸 VanKoh	2026-06-05 18:54:03 (2 days ago)	2602:80d:1007::79 - - [05/Jun/2026:12:53:33 -0600] "GET /robots.txt HTTP/1.1" 200 185 "-" "Mozilla/5 ... show more 2602:80d:1007::79 - - [05/Jun/2026:12:53:33 -0600] "GET /robots.txt HTTP/1.1" 200 185 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1007::79 - - [05/Jun/2026:12:53:44 -0600] "GET /favicon.ico HTTP/1.1" 302 5 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1007::79 - - [05/Jun/2026:12:54:03 -0600] "GET /oec9danqo HTTP/1.1" 404 43945 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" ... show less	Port Scan Web App Attack
🇩🇪 4server	2026-06-05 12:24:16 (2 days ago)	[FriJun0514:24:10.9016772026][security2:error][pid733449:tid733551][client2602:80d:1007::79:0]ModSec ... show more [FriJun0514:24:10.9016772026][security2:error][pid733449:tid733551][client2602:80d:1007::79:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"www.selenemodestipastrydetails.it\"][uri\"/\"][unique_id\"aiK_6t7i8RLWt4lZVguZYAAAAMs\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 Starburst SysOp Team	2026-06-02 13:07:12 (5 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-14)	Hacking Bad Web Bot
🇩🇪 4server	2026-05-31 01:39:50 (1 week ago)	[SunMay3103:39:45.4842472026][security2:error][pid411227:tid411337][client2602:80d:1007::79:0]ModSec ... show more [SunMay3103:39:45.4842472026][security2:error][pid411227:tid411337][client2602:80d:1007::79:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"titraslochi.ch\"][uri\"/\"][unique_id\"ahuRYZCQ_YqXdVbE_JpbEQAAAM0\"] show less	Port Scan Brute-Force Web App Attack
🇬🇧 pinguin	2026-05-27 22:40:40 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 4server	2026-05-25 02:16:46 (2 weeks ago)	[MonMay2504:16:42.2311552026][security2:error][pid3413722:tid3413856][client2602:80d:1007::79:0]ModS ... show more [MonMay2504:16:42.2311552026][security2:error][pid3413722:tid3413856][client2602:80d:1007::79:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"ahOxCp0pYLbT-C5E3at2LQAAARI\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 Starburst SysOp Team	2026-05-24 14:52:15 (2 weeks ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-nue6-1)	Hacking Bad Web Bot
🇨🇭 4server	2026-05-23 15:02:17 (2 weeks ago)	[SatMay2317:02:10.1726962026][security2:error][pid2684725:tid2684733][client2602:80d:1007::79:0]ModS ... show more [SatMay2317:02:10.1726962026][security2:error][pid2684725:tid2684733][client2602:80d:1007::79:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a02:29b8:dc01:545::625:de4f\"][uri\"/\"][unique_id\"ahHBcq_fKnNq2LPXwk9ycAAAAQY\"] show less	Hacking Web App Attack
🇩🇪 4server	2026-05-22 06:01:38 (2 weeks ago)	[FriMay2208:01:36.2445152026][security2:error][pid3110199:tid3110237][client2602:80d:1007::79:0]ModS ... show more [FriMay2208:01:36.2445152026][security2:error][pid3110199:tid3110237][client2602:80d:1007::79:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"www.rvengineering.ch\"][uri\"/\"][unique_id\"ag_xQJP9Jc4V13tNw8v_EgAAAA8\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 Jimbo67	2026-05-21 22:27:50 (2 weeks ago)	Detected by CrowdSec on arleo.eu \| Scenario: http-bad-user-agent \| Origin: crowdsec \| URIs: /, /json ... show more Detected by CrowdSec on arleo.eu \| Scenario: http-bad-user-agent \| Origin: crowdsec \| URIs: /, /jsonrpc, /apple-touch-icon.png, /favicon-16x16.png, /favicon-32x32.png show less	Web App Attack Bad Web Bot
🇩🇪 4server	2026-05-20 18:08:31 (2 weeks ago)	[WedMay2020:08:26.4779832026][security2:error][pid667941:tid668075][client2602:80d:1007::79:0]ModSec ... show more [WedMay2020:08:26.4779832026][security2:error][pid667941:tid668075][client2602:80d:1007::79:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"mail.safeoncloud.ch\"][uri\"/\"][unique_id\"ag34mg9tVZdIjdu5upgszwAAARY\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 Jimbo67	2026-05-20 06:05:50 (2 weeks ago)	Detected by CrowdSec on arleo.eu \| Scenario: http-bad-user-agent \| Origin: cscli \| URIs: /, /jsonrpc ... show more Detected by CrowdSec on arleo.eu \| Scenario: http-bad-user-agent \| Origin: cscli \| URIs: /, /jsonrpc, /apple-touch-icon.png, /favicon-16x16.png, /favicon-32x32.png show less	Web App Attack Bad Web Bot

Showing 1 to 15 of 60 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:4:8bf7:1

🇨🇳 117.81.212.152

🇨🇳 59.52.102.152

🇨🇳 58.23.78.222

🇻🇪 38.3.195.30

🇺🇸 34.144.176.26

🇯🇵 8.216.2.27

🇷🇴 2.57.121.25

🇺🇸 2604:a880:400:d1:0:4:8bf6:f001

🇧🇷 205.210.31.185

🇭🇺 185.196.54.85

🇸🇬 103.250.11.176

🇷🇴 80.94.95.116

🇷🇴 80.94.92.233

🇬🇧 34.39.72.131

🇳🇱 5.61.209.33

🇺🇸 2a02:4780:2b:2099:0:2f01:372e:1

🇺🇸 2604:a880:400:d1:0:4:8bf7:d001

🇨🇭 209.99.186.114

🇭🇰 202.73.4.182