AbuseIPDB » 2604:a880:400:d0::1d45:e001

2604:a880:400:d0::1d45:e001 was found in our database!

This IP was reported 95 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	DigitalOcean LLC
Usage Type	Data Center/Web Hosting/Transit
Domain Name	digitalocean.com
Country	United States of America
City	North Bergen, New Jersey

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 2604:a880:400:d0::1d45:e001

Whois 2604:a880:400:d0::1d45:e001

IP Abuse Reports for 2604:a880:400:d0::1d45:e001:

This IP address has been reported a total of 95 times from 43 distinct sources. 2604:a880:400:d0::1d45:e001 was first reported on September 9th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
geot	2024-09-23 12:06:36 (2 weeks ago)	GET /.env HTTP/1.1	Hacking Web App Attack
hyperdefined	2024-09-21 23:15:06 (2 weeks ago)	[fail2ban Auto Report] 2604:a880:400:d0::1d45:e001 - - [21/Sep/2024:19:15:05 -0400] "GET /.env HTTP/ ... show more[fail2ban Auto Report] 2604:a880:400:d0::1d45:e001 - - [21/Sep/2024:19:15:05 -0400] "GET /.env HTTP/1.1" 301 162 "-" "python-httpx/0.26.0" ... show less	Brute-Force Web App Attack
beehivecybersec	2024-09-21 21:03:17 (2 weeks ago)	Malicious activity detected from 14061 DIGITALOCEAN-ASN towards host changelog.beehive.systems (GET ... show moreMalicious activity detected from 14061 DIGITALOCEAN-ASN towards host changelog.beehive.systems (GET HTTP/1.1) @ 2024-09-21T21:03:17Z show less	Open Proxy VPN IP Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
HERA - Operations	2024-09-21 15:23:13 (2 weeks ago)	herrmann - searching for vulnerable scripts: .env 2024/09/21 17:23:13	Web App Attack
Gwyneth Llewelyn	2024-09-21 10:05:44 (2 weeks ago)	2024/09/21 11:05:25 [error] 2061#2061: 1924619 access forbidden by rule, client: 2604:a880:400:d0:: ... show more2024/09/21 11:05:25 [error] 2061#2061: 1924619 access forbidden by rule, client: 2604:a880:400:d0::1d45:e001, server: alzulej.pt, request: "GET /.env HTTP/2.0", host: "alzulej.pt" 2604:a880:400:d0::1d45:e001 - - [21/Sep/2024:11:05:25 +0100] "GET /.env HTTP/2.0" 403 1045 "-" "python-httpx/0.26.0" 2024/09/21 11:05:42 [error] 2057#2057: *1924675 access forbidden by rule, client: 2604:a880:400:d0::1d45:e001, server: apcoelho.pt, request: "GET /.env HTTP/2.0", host: "apcoelho.pt" show less	Web App Attack
Ba-Yu	2024-09-21 07:12:07 (3 weeks ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
✨	2024-09-21 02:55:02 (3 weeks ago)	Domain : tripoli-spain.org Rule : env 2024-09-21 02:54:40 152.53.103.155 GET /.env - 443 ... show moreDomain : tripoli-spain.org Rule : env 2024-09-21 02:54:40 152.53.103.155 GET /.env - 443 - 172.70.114.160 HTTP/2 python-httpx/0.26.0 - tripoli-spain.org 301 0 0 168 358 234 - 2604:a880:400:d0::1d45:e001 show less	Hacking SQL Injection
Starburst SysOp Team	2024-09-21 01:55:10 (3 weeks ago)	(mod_security-custom) mod_security (id:210492) triggered by 2604:a880:400:d0::1d45:e001 (Unknown): 1 ... show more(mod_security-custom) mod_security (id:210492) triggered by 2604:a880:400:d0::1d45:e001 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [Sat Sep 21 01:55:09.650497 2024] [:error] [pid 2694840:tid 2694877] [client 2604:a880:400:d0::1d45:e001:37742] [client 2604:a880:400:d0::1d45:e001] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "almalinux-elevate.stl.us.ssimn.org"] [uri "/.env"] [unique_id "Zu4nfSMY3nlr5ObtuuR08AAAAAc"] show less	Hacking
Starburst SysOp Team	2024-09-21 01:55:00 (3 weeks ago)	[Sat Sep 21 01:55:09.948031 2024] [:error] [pid 3061760:tid 3061787] [client 2604:a880:400:d0::1d45: ... show more[Sat Sep 21 01:55:09.948031 2024] [:error] [pid 3061760:tid 3061787] [client 2604:a880:400:d0::1d45:e001:47206] [client 2604:a880:400:d0::1d45:e001] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "almalinux-elevate.sg.ssimn.org"] [uri "/.env"] [unique_id "Zu4nfexMX-gwgz5JvaNpfwAAAUA"] show less	Hacking Brute-Force Web App Attack
NotACaptcha	2024-09-20 20:25:52 (3 weeks ago)	webserver:80 [20/Sep/2024] "GET /.env HTTP/1.1" 404 397 "-" "python-httpx/0.26.0"	Web App Attack
bigorre.org	2024-09-20 18:27:58 (3 weeks ago)	suspicious query, try to find configuration parameters log:/.env	Web App Attack
axllent	2024-09-20 18:26:04 (3 weeks ago)	Scanning for exploits - /.env	Web App Attack
Sefinek	2024-09-20 12:09:33 (3 weeks ago)	Triggered Cloudflare WAF (firewallCustom). Action taken: BLOCK ASN: 14061 (DIGITALOCEAN- ... show moreTriggered Cloudflare WAF (firewallCustom). Action taken: BLOCK ASN: 14061 (DIGITALOCEAN-ASN) [US] Protocol: HTTP/1.1 (method GET) Domain: noel.sefinek.net Endpoint: /.env Timestamp: 2024-09-20T04:09:27Z Ray ID: 8c5ef5cc0d0e1a0f Rule ID: 28ce88ae31c84d638aec7f360a4f64af UA: python-httpx/0.26.0 Report generated by Node-Cloudflare-WAF-AbuseIPDB https://github.com/sefinek24/Node-Cloudflare-WAF-AbuseIPDB show less	Bad Web Bot
cmbplf	2024-09-20 09:29:50 (3 weeks ago)	106 requests to *.env	Brute-Force Bad Web Bot
Anonymous	2024-09-20 09:29:38 (3 weeks ago)	Detected abusive req: GET /.env User Agent: python-httpx/0.26.0. Reason: AID hint	Hacking Bad Web Bot