This IP was reported 494 times. Confidence of
Abuse
is 2%: ?
2%
Important Note: Public IPv6 addresses may implement the SLAAC
privacy extension. With this, the interface identifier is randomly generated. The SLAAC
privacy extension also implements a time out, which is configurable, so that the IPv6
interface addresses will be discarded and a new interface identifier is generated.
This IP address has been reported a total of
494
times from
175 distinct
sources.
2602:fb54:99b:: was first reported on
, and the most recent report was
.
Old Reports:
The most recent abuse report for this IP address is from
. It is possible that this IP is no longer involved in abusive activities.
(mod_security) mod_security (id:210730) triggered by 2602:fb54:99b:: (Unknown): 1 in the last 300 se ...
show more(mod_security) mod_security (id:210730) triggered by 2602:fb54:99b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 14:05:41.104193 2026] [security2:error] [pid 24506:tid 24595] [client 2602:fb54:99b:::0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.mynolahome.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.mynolahome.com"] [uri "/wp-content/debug.log"] [unique_id "aimndWlUDVwqaAUwfBB8qwAAAJM"]
show less
67x HTTP 403/404 responses in short timeframe. Likely vulnerability scanner or brute-force attack on ...
show more67x HTTP 403/404 responses in short timeframe. Likely vulnerability scanner or brute-force attack on web application paths.
show less
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Automated scan targeting an unauthori ...
show moreDetectors: [NGINX] | Reasons: Nginx: Default server trap hit | Automated scan targeting an unauthorized host or default server sinkhole | Tech Evidence: Minimal-Browser-Profile, Lazy-Header-Accept, Fake-Chrome-Desktop (No-CH), TLS-JA4-Spoofing-Detected (UA claims Browser but JA4 reports No-HTTP/2: t13d131000), JA4: t13d131000 | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
show less
[WedJun1003:17:54.6033852026][security2:error][pid3771161:tid3771176][client2602:fb54:99b:::0]ModSec ...
show more[WedJun1003:17:54.6033852026][security2:error][pid3771161:tid3771176][client2602:fb54:99b:::0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"mail.essesolution.ch\"][uri\"/wp-content/debug.log\"][unique_id\"aii7QljgjiorTQWXvrHZVwAAAAI\"]
show less
(modsecurity) srv104 ModSecurity 2602:fb54:99b:: (US/United States/-): 10 in the last 3600 secs; Por ...
show more(modsecurity) srv104 ModSecurity 2602:fb54:99b:: (US/United States/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less