JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2605:6400:30:f174::

2605:6400:30:f174:: was found in our database!

This IP was reported 75 times. Confidence of Abuse is 29%: ?

29%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	FranTech Solutions
Usage Type	Data Center/Web Hosting/Transit
ASN	AS53667
Hostname(s)	polyphemus.brandonkuschel.com
Domain Name	frantech.ca
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2605:6400:30:f174::

Whois 2605:6400:30:f174::

IP Abuse Reports for 2605:6400:30:f174:::

This IP address has been reported a total of 75 times from 15 distinct sources. 2605:6400:30:f174:: was first reported on March 13th 2024, and the most recent report was 23 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-11 23:08:25 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel. ... show more (mod_security) mod_security (id:210492) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 19:08:19.749598 2026] [security2:error] [pid 4550:tid 4550] [client 2605:6400:30:f174:::28125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.cfconnectionsgallery.com"] [uri "/.git/config"] [unique_id "ais_44onYE41esiQYVt7nQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 HandyTreff.de	2026-06-04 23:05:28 (1 week ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -88.327 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -88.327 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26. show less	Web App Attack Bad Web Bot
🇺🇸 ipblock.com	2026-05-26 21:53:00 (2 weeks ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-05-19 13:20:00 (3 weeks ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-06 19:31:58 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel. ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 15:31:52.510736 2026] [security2:error] [pid 17057:tid 17057] [client 2605:6400:30:f174:::51097] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|faithlines.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "faithlines.com"] [uri "/fai.sql"] [unique_id "afuXKJZfeWfj43emZEVwAwAAACk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-05 14:59:40 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 41463 Packet length: 80 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 8333) Source port: 41463 Packet length: 80 This report (for 2605:6400:0030:f174:0000:0000:0000:0000) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-04-26 21:02:25 (1 month ago)	2026-04-26 08:00:32,318 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174:: 2026-0 ... show more 2026-04-26 08:00:32,318 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174:: 2026-04-26 12:01:28,532 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174:: 2026-04-26 18:01:26,341 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174:: 2026-04-26 21:01:23,513 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174:: 2026-04-27 00:02:25,064 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174:: show less	Brute-Force
🇨🇭 4server	2026-04-15 19:19:08 (1 month ago)	[WedApr1521:19:02.4106072026][security2:error][pid1259108:tid1259111][client2605:6400:30:f174:::0]Mo ... show more [WedApr1521:19:02.4106072026][security2:error][pid1259108:tid1259111][client2605:6400:30:f174:::0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"359\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"tipicalonline.com\"][uri\"/wp-content/plugins/\*\\\\\"\,\\\\\"/readme.txt\"][unique_id\"ad_kptKZ2eV_XMHh-YuVBQAAAME\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 19:39:04 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel. ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 15:38:56.165822 2026] [security2:error] [pid 12241:tid 12265] [client 2605:6400:30:f174:::59905] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|datuinc.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "datuinc.com"] [uri "/datui.sql"] [unique_id "ac7F0I1D_VpHQqsQmv3QFwAAARQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-03-26 20:10:59 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-05 13:28:32 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel. ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 08:28:23.726887 2026] [security2:error] [pid 23480:tid 23480] [client 2605:6400:30:f174:::32505] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|aboutagingparents.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aboutagingparents.com"] [uri "/dbrents.sql"] [unique_id "aamE910sSCVxgpHEHt-WmwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-03-04 19:56:19 (3 months ago)	2026-03-04 20:56:19 (CET) ~ Blocked by abusescan risk assessment	Web App Attack
🇺🇸 TPI-Abuse	2026-02-16 01:35:31 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel. ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 20:35:26.466414 2026] [security2:error] [pid 1199039:tid 1199039] [client 2605:6400:30:f174:::34581] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|shhcenter.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "shhcenter.com"] [uri "/shhc.sql"] [unique_id "aZJ0Xj5dfwpSwrdf-62JlwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-02-03 07:27:04 (4 months ago)	Blocked by UFW (TCP on 8333) Source port: 30035 Packet length: 80 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 8333) Source port: 30035 Packet length: 80 This report (for 2605:6400:0030:f174:0000:0000:0000:0000) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-01-04 08:30:39 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel. ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174:: (polyphemus.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 03:30:30.971428 2026] [security2:error] [pid 16424:tid 16520] [client 2605:6400:30:f174:::50521] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|artmarialeon.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "artmarialeon.com"] [uri "/tmarialeon_com.sql"] [unique_id "aVolJt2YEftkG6cKu7uKMwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 75 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 213.177.179.80

🇬🇧 185.192.69.253

🇬🇧 185.192.69.236

🇫🇮 147.185.133.99

🇫🇷 2001:41d0:33a:a00::406

🇷🇺 176.118.22.128

🇵🇱 87.251.64.145

🇫🇷 84.247.129.208

🇧🇷 45.170.144.62

🇳🇱 45.148.10.147

🇧🇷 152.32.200.213

🇻🇳 113.164.66.10

🇵🇰 103.211.195.82

🇺🇸 65.73.230.102

🇸🇬 43.134.27.142

🇺🇸 24.144.84.83

🇪🇸 2a00:1d24:409:92:9999::7

🇺🇸 166.1.60.230

🇺🇸 162.216.150.5

🇻🇳 125.212.244.35