JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2602:80d:1008::73

2602:80d:1008::73 was found in our database!

This IP was reported 204 times. Confidence of Abuse is 87%: ?

87%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Censys, Inc.
Usage Type	Commercial
ASN	AS398324
Domain Name	censys.com
Country	🇺🇸 United States of America
City	Chicago, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2602:80d:1008::73

Whois 2602:80d:1008::73

IP Abuse Reports for 2602:80d:1008::73:

This IP address has been reported a total of 204 times from 55 distinct sources. 2602:80d:1008::73 was first reported on March 22nd 2026, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 LotPhantom	2026-09-18 12:54:54 (13 hours ago)	2602:80d:1008::73 - - [18/Sep/2026:12:53:54 +0000] "GET / HTTP/1.1" 404 146 "-" "Mozilla/5.0 (compat ... show more 2602:80d:1008::73 - - [18/Sep/2026:12:53:54 +0000] "GET / HTTP/1.1" 404 146 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "0" ... show less	Web App Attack
🇩🇪 4server	2026-09-18 12:24:13 (13 hours ago)	[FriSep1814:24:08.9952312026][security2:error][pid3617909:tid3617921][client2602:80d:1008::73:0]ModS ... show more [FriSep1814:24:08.9952312026][security2:error][pid3617909:tid3617921][client2602:80d:1008::73:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"maxay.ch\"][uri\"/\"][unique_id\"aq0taO6NRF9A1d2FIOKEIAAAAUI\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 HoneyPotFRI	2026-09-17 07:04:14 (1 day ago)	2602:80d:1008::73 - - [17/Sep/2026:09:03:59 +0200] "x16x03x01x00xEEx01x00x00xEAx03x03pSx99xB0kx0CxAF ... show more 2602:80d:1008::73 - - [17/Sep/2026:09:03:59 +0200] "x16x03x01x00xEEx01x00x00xEAx03x03pSx99xB0kx0CxAF=x18/xEE&j~<axADx0CQx0Cx17xAF@xD881(;+vx8Fx0C HHYxF1xC01xA6x9FxB7GV/x ... show less	Bad Web Bot Web App Attack
🇺🇸 Starburst SysOp Team	2026-09-16 06:02:23 (2 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-17)	Hacking Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-09-16 04:52:38 (2 days ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-13)	Hacking Bad Web Bot
🇯🇵 gomasy	2026-09-15 16:36:25 (3 days ago)	_:80 2602:80d:1008::73 - - [16/Sep/2026:01:36:25 +0900] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x0 ... show more _:80 2602:80d:1008::73 - - [16/Sep/2026:01:36:25 +0900] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xA4\x90\xCCJ:%jxS\xC5\x01\xA4\xBF\x88u\xDB\x1Af\xBD\x97y*\xAC\x15}c\x03\xFC\x15\xEAc\xE9 \xBD\x92\x90\xCD\xBE\x1F\xAC\xD1\xA8\x90\x1D\xC0F\x12\x06[\xA2\x5C.\xCC\x9A:\x04y'\x8E\xFF\xB0\x86\x01hq\x00&\xCC\xA8\xCC\xA9\xC0/\xC00\xC0+\xC0,\xC0\x13\xC0\x09\xC0\x14\xC0" 500 170 "-" "-" ... show less	Web App Attack
🇩🇪 4server	2026-09-15 00:24:05 (4 days ago)	[TueSep1502:24:00.6683752026][security2:error][pid2505613:tid2505720][client2602:80d:1008::73:0]ModS ... show more [TueSep1502:24:00.6683752026][security2:error][pid2505613:tid2505720][client2602:80d:1008::73:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqiQIONdyvvv09OOTB1ooQAAARA\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-13 21:01:47 (5 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 4server	2026-09-13 14:50:03 (5 days ago)	[SunSep1316:49:59.6842782026][security2:error][pid534458:tid534652][client2602:80d:1008::73:0]ModSec ... show more [SunSep1316:49:59.6842782026][security2:error][pid534458:tid534652][client2602:80d:1008::73:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"2a01:4f8:212:1561::8\"][uri\"/\"][unique_id\"aqa4F4a1EaexhnYNvZapUwAAAJI\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 alsmanifesto	2026-09-12 01:57:55 (1 week ago)	Enumerated subdomains that host no service (n8n.fluentops.org) against fluentops.org. 1 request, 202 ... show more Enumerated subdomains that host no service (n8n.fluentops.org) against fluentops.org. 1 request, 2026-09-12 01:57:54 UTC. Blocked at our edge. show less	Port Scan Bad Web Bot
🇩🇪 ecs.ge	2026-09-10 10:05:58 (1 week ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇺🇸 distorx	2026-09-10 01:42:53 (1 week ago)	[10/Sep/2026:01:42:52 +0000] 400 - - http localhost-nginx-proxy-manager "-" [Client 2602:80d:1008::7 ... show more [10/Sep/2026:01:42:52 +0000] 400 - - http localhost-nginx-proxy-manager "-" [Client 2602:80d:1008::73] [Length 154] [Gzip -] "-" "-" ... show less	Port Scan Bad Web Bot
🇩🇪 4server	2026-09-09 15:27:17 (1 week ago)	[WedSep0917:27:14.9960892026][security2:error][pid3220594:tid3220653][client2602:80d:1008::73:0]ModS ... show more [WedSep0917:27:14.9960892026][security2:error][pid3220594:tid3220653][client2602:80d:1008::73:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bshodan\\\\\\\\b\\|\\\\\\\\bcensysinspect\\\\\\\\b\\|\\\\\\\\bcensys\\\\\\\\b\\|\\\\\\\\bexpanse\\\\\\\\b\\|\\\\\\\\bnetsystemsresearch\\\\\\\\b\\|\\\\\\\\bnetcraftsurveyagent\\\\\\\\b\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"73\"][id\"338801\"][rev\"1\"][msg\"Atomicorp.comWAFRules:Blockedinternet-widesurveyorUA\"][severity\"ERROR\"][hostname\"pluriball.ch\"][uri\"/\"][unique_id\"aqF60kl9iGo4LqA5RREmkAAAAdU\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 LRob	2026-09-08 12:52:47 (1 week ago)	Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5 ... show more Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) \| path: / \| 2026-09-08 12:52 UTC show less	Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-09-07 07:26:08 (1 week ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-stl2-14)	Hacking Bad Web Bot

Showing 1 to 15 of 204 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.197

🇺🇸 185.226.196.14

🇰🇷 121.156.19.13

🇺🇸 68.166.173.236

🇺🇸 66.132.195.121

🇿🇦 41.13.191.156

🇺🇸 205.210.31.37

🇧🇪 198.235.24.169

🇬🇧 193.32.209.227

🇲🇽 189.217.130.86

🇲🇽 187.192.252.184

🇧🇩 103.179.125.168

🇻🇳 103.159.51.70

🇪🇸 89.128.44.92

🇧🇬 79.124.40.142

🇱🇹 62.60.130.201

🇺🇸 52.165.83.218

🇳🇱 45.148.10.157

🇮🇩 34.50.109.19

🇺🇸 20.80.98.237