JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2602:80d:1008::56

2602:80d:1008::56 was found in our database!

This IP was reported 191 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Domain Name	censys.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2602:80d:1008::56

Whois 2602:80d:1008::56

IP Abuse Reports for 2602:80d:1008::56:

This IP address has been reported a total of 191 times from 56 distinct sources. 2602:80d:1008::56 was first reported on March 22nd 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 2000cn.com.au	2026-08-23 08:11:42 (22 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 4server	2026-08-23 06:56:06 (1 day ago)	[SunAug2308:56:01.3536212026][security2:error][pid3522696:tid3522787][client2602:80d:1008::56:0]ModS ... show more [SunAug2308:56:01.3536212026][security2:error][pid3522696:tid3522787][client2602:80d:1008::56:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aoqZgSXgNWY3WGfI_XPCggAAAQE\"] show less	Port Scan Brute-Force Web App Attack
🇦🇺 Starburst SysOp Team	2026-08-22 06:54:15 (2 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-syd2-4)	Hacking Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-08-20 17:57:57 (3 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-mnz6-4)	Hacking Bad Web Bot
🇩🇪 4server	2026-08-20 15:08:46 (3 days ago)	[ThuAug2017:08:42.6035202026][security2:error][pid4018669:tid4018707][client2602:80d:1008::56:0]ModS ... show more [ThuAug2017:08:42.6035202026][security2:error][pid4018669:tid4018707][client2602:80d:1008::56:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aocYet-U7uzan7-svhavcQAAAII\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 Melle	2026-08-20 01:57:06 (4 days ago)	Blocked by CrowdSec \| Scenario: crowdsecurity/http-bad-user-agent \| 2602:80d:1008::56 triggered 2 ev ... show more Blocked by CrowdSec \| Scenario: crowdsecurity/http-bad-user-agent \| 2602:80d:1008::56 triggered 2 events \| Detected: 2026-08-20T01:57:03.559070127Z show less	Web App Attack Bad Web Bot
🇩🇪 23p02732	2026-08-19 12:00:44 (4 days ago)	Automated web scanning and malicious probing	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-08-19 08:35:45 (4 days ago)	[WedAug1910:35:42.3598972026][security2:error][pid2193802:tid2193904][client2602:80d:1008::56:0]ModS ... show more [WedAug1910:35:42.3598972026][security2:error][pid2193802:tid2193904][client2602:80d:1008::56:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"hdcadvisory.ch\"][uri\"/\"][unique_id\"aoVq3nC0XHjY7mWGQT1nMgAAAgk\"] show less	Port Scan Brute-Force Web App Attack
🇳🇴 noteng.no	2026-08-19 05:07:50 (5 days ago)	2602:80d:1008::56 - - [19/Aug/2026:07:07:42 +0200] "GET / HTTP/1.1" 400 150 "-" "Mozilla/5.0 (compat ... show more 2602:80d:1008::56 - - [19/Aug/2026:07:07:42 +0200] "GET / HTTP/1.1" 400 150 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" 2602:80d:1008::56 - - [19/Aug/2026:07:07:42 +0200] "PRI * HTTP/2.0" 400 150 "-" "-" 2602:80d:1008::56 - - [19/Aug/2026:07:07:46 +0200] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xA3\x03=#\xF0s~\xDDI\xFB}\xAD(\xF6\xBA\x1D\xC1\x9A\x07~O\xCDV\xE3\xDFf\xC3\xD0\x16i'\x99 /\xA0He~\xF7hq!\x0B\xE2\xA7\xE4\x04%\xFCu\xC5/\xC7)\xBF\x86\x99o\x9C\xD6d\xC7\x17L/\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 400 150 "-" "-" ... show less	Hacking Web App Attack
🇩🇪 LRob	2026-08-18 15:06:27 (5 days ago)	Requests sent with a known malicious or scanner user-agent \| req: / \| UA: Mozilla/5.0 (compatible; C ... show more Requests sent with a known malicious or scanner user-agent \| req: / \| UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) show less	Bad Web Bot
🇦🇺 2000cn.com.au	2026-08-18 03:57:00 (6 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 ecs.ge	2026-08-17 02:48:16 (1 week ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇳🇱 BlueWire Hosting	2026-08-16 10:46:12 (1 week ago)	Bad bot ignoring robot.txt	Bad Web Bot
🇸🇬 Starburst SysOp Team	2026-08-16 06:30:29 (1 week ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-sin2-2)	Hacking Bad Web Bot
🇨🇭 4server	2026-08-16 02:13:46 (1 week ago)	[SunAug1604:13:40.7897232026][security2:error][pid971059:tid971307][client2602:80d:1008::56:0]ModSec ... show more [SunAug1604:13:40.7897232026][security2:error][pid971059:tid971307][client2602:80d:1008::56:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"swisservers.com\"][uri\"/\"][unique_id\"aoEc1O6kiHvf6wcW3shIHgAAAVY\"] show less	Hacking Web App Attack

Showing 1 to 15 of 191 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 160.251.202.50

🇨🇦 144.217.243.186

🇧🇷 138.99.99.5

🇨🇳 111.22.5.101

🇺🇸 104.35.4.255

🇨🇿 78.44.192.210

🇺🇸 66.132.195.18

🇺🇸 66.132.186.222

🇰🇷 59.8.107.113

🇫🇷 31.220.76.64

🇺🇸 2400:cb00:119:1000:a15f:e1d6:9e9b:b539

🇰🇷 222.99.52.202

🇸🇬 213.35.106.249

🇨🇼 190.88.137.74

🇺🇸 174.169.87.211

🇺🇸 162.216.150.212

🇺🇸 162.216.149.128

🇭🇰 144.48.243.18

🇮🇩 116.197.135.133

🇺🇸 103.203.57.2