This IP was reported 54 times. Confidence of
Abuse
is 71%: ?
71%
Important Note: Public IPv6 addresses may implement the SLAAC
privacy extension. With this, the interface identifier is randomly generated. The SLAAC
privacy extension also implements a time out, which is configurable, so that the IPv6
interface addresses will be discarded and a new interface identifier is generated.
This IP address has been reported a total of
54
times from
22 distinct
sources.
2602:80d:1007::c9 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[WedJun0317:04:13.2832332026][security2:error][pid1922962:tid1923030][client2602:80d:1007::c9:0]ModS ...
show more[WedJun0317:04:13.2832332026][security2:error][pid1922962:tid1923030][client2602:80d:1007::c9:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\|\\\\\\\\bcensysinspect\\\\\\\\b\|\\\\\\\\bcensys\\\\\\\\b\|\\\\\\\\bexpanse\\\\\\\\b\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aiBCba22sc38SczFwHu7OAAAAFc\"]
show less
[WedJun0301:36:09.0357372026][security2:error][pid98125:tid98437][client2602:80d:1007::c9:0]ModSecur ...
show more[WedJun0301:36:09.0357372026][security2:error][pid98125:tid98437][client2602:80d:1007::c9:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\|\\\\\\\\bcensysinspect\\\\\\\\b\|\\\\\\\\bcensys\\\\\\\\b\|\\\\\\\\bexpanse\\\\\\\\b\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"mail.leonitraslochi.ch\"][uri\"/\"][unique_id\"ah9o6WXOxCurfZqeDQu8LAAAAMw\"]
show less
[SatMay3018:15:02.6334832026][security2:error][pid4000126:tid4000201][client2602:80d:1007::c9:0]ModS ...
show more[SatMay3018:15:02.6334832026][security2:error][pid4000126:tid4000201][client2602:80d:1007::c9:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\|\\\\\\\\bcensysinspect\\\\\\\\b\|\\\\\\\\bcensys\\\\\\\\b\|\\\\\\\\bexpanse\\\\\\\\b\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"www.lascalasagl.ch\"][uri\"/\"][unique_id\"ahsNBmZoX-0HtF-cj6HQAwAAAIU\"]
show less
Port Scan
Brute-Force
Web App Attack
Anonymous
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
[TueMay2606:10:14.2324132026][security2:error][pid920662:tid920796][client2602:80d:1007::c9:0]ModSec ...
show more[TueMay2606:10:14.2324132026][security2:error][pid920662:tid920796][client2602:80d:1007::c9:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\|\\\\\\\\bcensysinspect\\\\\\\\b\|\\\\\\\\bcensys\\\\\\\\b\|\\\\\\\\bexpanse\\\\\\\\b\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"mail.giuliani.li\"][uri\"/\"][unique_id\"ahUdJgF6G_YmTI_A-T0TfQAAAM0\"]
show less
[WedMay2022:17:41.3969142026][security2:error][pid4151993:tid4152001][client2602:80d:1007::c9:0]ModS ...
show more[WedMay2022:17:41.3969142026][security2:error][pid4151993:tid4152001][client2602:80d:1007::c9:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\|\\\\\\\\bcensysinspect\\\\\\\\b\|\\\\\\\\bcensys\\\\\\\\b\|\\\\\\\\bexpanse\\\\\\\\b\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"whatsdecor.ch\"][uri\"/\"][unique_id\"ag4W5RbmTFNI_d4L_me9uQAAAAY\"]
show less
Blocked by CrowdSec | Scenario: crowdsecurity/http-bad-user-agent | 2602:80d:1007::c9 triggered 2 ev ...
show moreBlocked by CrowdSec | Scenario: crowdsecurity/http-bad-user-agent | 2602:80d:1007::c9 triggered 2 events | Detected: 2026-05-18T21:03:25.33679739Z
show less
Web App Attack
Bad Web Bot
Showing 1 to
15
of 54 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩