JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2604:a880:cad:d0::bfa:d001

Neutral Activity IPv6 SLAAC Note

Abuse confidence score ?

0% Low Risk

16 reports

14 reporters · latest 2 months ago

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇨🇦 Canada
City	Toronto, Ontario

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

2604:a880:cad:d0::bfa:d001 has been reported 16 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 2604:a880:cad:d0::bfa:d001

Export CSV

This IP address has been reported a total of 16 times from 14 distinct sources. 2604:a880:cad:d0::bfa:d001 was first reported on July 5th 2024, and the most recent report was 2 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Lezetho	2026-08-09 11:00:14 (2 months ago)	DDoS, WebSpam, Web Attack, and Brute-force blocked by Cloudflare	DDoS Attack Email Spam Hacking Brute-Force
🇺🇸 anti-res	2026-05-08 13:04:37 (5 months ago)	Attempt of unauthorized access	Port Scan Bad Web Bot Web App Attack
🇫🇮 as211431.net	2026-03-05 22:30:26 (7 months ago)	Triggered Cloudflare WAF (linkMaze) from CA. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/2 (GET ... show more Triggered Cloudflare WAF (linkMaze) from CA. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/2 (GET method) Endpoint: / UA: req/v3 (https://github.com/imroc/req) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-05 19:32:51 (8 months ago)	(mod_security) mod_security (id:217291) triggered by 2604:a880:cad:d0::bfa:d001 (Unknown): 1 in the ... show more (mod_security) mod_security (id:217291) triggered by 2604:a880:cad:d0::bfa:d001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 14:32:46.070410 2026] [security2:error] [pid 4626:tid 4626] [client 2604:a880:cad:d0::bfa:d001:38321] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(\\\\n\|\\\\r)" at ARGS_NAMES:\\r\\ntimestamp. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "145"] [id "217291"] [rev "2"] [msg "HTTP Header Injection Attack via payload (CR/LF detected)\|\|drlwr.com\|F\|2"] [data "Matched Data: \\x0d found within ARGS_NAMES:\\x5cr\\x5cntimestamp: \\x0d\\x0atimestamp"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "drlwr.com"] [uri "/track/open"] [unique_id "aYTwXvtfUdZt-C7QnbVtSAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 wpwoodo	2026-01-12 20:28:46 (9 months ago)	Webpage crawler	Bad Web Bot
🇵🇱 ketovoila.pl	2026-01-08 01:57:51 (9 months ago)	ketovoila.pl HONEYPOT traffic: count=2, paths=1; sample_path=ketovoila.pl/; UA=Mozilla/5.0 (Windows ... show more ketovoila.pl HONEYPOT traffic: count=2, paths=1; sample_path=ketovoila.pl/; UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0; window=2026-01-08T01:32:45Z..2026-01-08T01:32:42Z show less	Port Scan Hacking Brute-Force
🇩🇪 kranem	2025-12-19 18:00:46 (10 months ago)	Triggered Cloudflare WAF from CA. Action taken: BLOCK ASN: 14061 (DIGITALOCEAN-ASN) Protocol: HTTP/2 ... show more Triggered Cloudflare WAF from CA. Action taken: BLOCK ASN: 14061 (DIGITALOCEAN-ASN) Protocol: HTTP/2 (GET method) Endpoint: / Timestamp: 2025-12-19T15:16:28Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15 show less	Bad Web Bot
🇺🇸 anti-res	2025-12-01 16:03:16 (10 months ago)	Attempt of unauthorized access	Port Scan Bad Web Bot Web App Attack
🇳🇱 exxos	2025-10-06 23:08:34 (1 year ago)	Attacks with Bad user agents	Hacking
🇩🇪 Reinhard	2025-06-30 14:33:42 (1 year ago)	Unknown activity, but too many attacks with too many users.	Hacking
🇺🇸 sabrinagoom	2025-06-02 04:58:37 (1 year ago)	Triggered WAF (firewallCustom) from CA Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: ... show more Triggered WAF (firewallCustom) from CA Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1 show less	Bad Web Bot
🇪🇸 Serpes	2025-05-22 12:51:09 (1 year ago)	Suspicious activity detected	Web App Attack
🇺🇸 COMPLEX	2025-05-15 22:50:04 (1 year ago)	Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: BLOCK ASN: 14061 (DIGITALOCEAN-ASN) ... show more Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: BLOCK ASN: 14061 (DIGITALOCEAN-ASN) Protocol: HTTP/1.1 (GET method) Timestamp: 2025-05-15T22:46:33Z show less	Bad Web Bot
🇭🇰 smallbottle	2025-02-18 22:30:24 (1 year ago)	The IP has triggered Cloudflare WAF. action: block source: firewallCustom clientAsn: 14061 clientASN ... show more The IP has triggered Cloudflare WAF. action: block source: firewallCustom clientAsn: 14061 clientASNDescription: DIGITALOCEAN-ASN clientCountryName: CA clientIP: 2604:a880:cad:d0::bfa:d001 clientRequestHTTPMethodName: GET clientRequestHTTPProtocol: HTTP/1.1 clientRequestPath: /favicon.ico clientRequestQuery: datetime: 2025-02-18T22:11:25Z rayName: 91415a562a7336a4 ruleId: 4989f24696b94676961cd00c29a049bb userAgent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36. Report generated by Cloudflare-WAF-to-AbuseIPDB.(https://github.com/0123-smallbottle/Cloudflare-WAF-to-AbuseIPDB) About:(https://blog.smallbottle2.top/about) show less	Web Spam Bad Web Bot
🇺🇸 TPI-Abuse	2025-01-16 10:04:42 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 2604:a880:cad:d0::bfa:d001 (Unknown): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2604:a880:cad:d0::bfa:d001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 16 05:04:37.518613 2025] [security2:error] [pid 10357:tid 10357] [client 2604:a880:cad:d0::bfa:d001:34251] [client 2604:a880:cad:d0::bfa:d001] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fishpondmanagement.com"] [uri "/wp-config.php"] [unique_id "Z4jZtR0VK_uc2P_wvnOhpQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇲 178.160.230.97

🇮🇳 152.59.184.144

🇻🇳 117.6.44.221

🇸🇪 104.23.221.222

🇸🇪 104.23.221.24

🇺🇸 67.220.95.49

🇺🇸 216.180.246.135

🇦🇷 201.220.18.11

🇦🇷 191.84.216.100

🇲🇽 189.223.177.184

🇲🇽 189.203.205.94

🇨🇷 186.151.100.51

🇦🇷 181.116.45.66

🇺🇸 162.216.150.191

🇨🇳 120.232.115.57

🇨🇳 110.187.226.203

🇰🇷 106.251.244.178

🇸🇪 104.23.221.30

🇸🇪 104.23.217.121

🇳🇱 94.154.43.149