JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2605:6400:30:f174::42

2605:6400:30:f174::42 was found in our database!

This IP was reported 84 times. Confidence of Abuse is 25%: ?

25%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	FranTech Solutions
Usage Type	Data Center/Web Hosting/Transit
ASN	AS53667
Hostname(s)	polyphemus8.brandonkuschel.com
Domain Name	frantech.ca
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2605:6400:30:f174::42

Whois 2605:6400:30:f174::42

IP Abuse Reports for 2605:6400:30:f174::42:

This IP address has been reported a total of 84 times from 13 distinct sources. 2605:6400:30:f174::42 was first reported on February 25th 2024, and the most recent report was 16 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-06-30 20:32:19 (16 hours ago)	Blocked by UFW (TCP on 60236) Source port: 80 Packet length: 2290 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 60236) Source port: 80 Packet length: 2290 This report (for 2605:6400:0030:f174:0000:0000:0000:0042) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-30 08:01:07 (1 day ago)	Blocked by UFW (TCP on 42556) Source port: 80 Packet length: 1500 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 42556) Source port: 80 Packet length: 1500 This report (for 2605:6400:0030:f174:0000:0000:0000:0042) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-29 13:19:31 (1 day ago)	Blocked by UFW (TCP on 43236) Source port: 80 Packet length: 2304 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 43236) Source port: 80 Packet length: 2304 This report (for 2605:6400:0030:f174:0000:0000:0000:0042) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-28 16:26:35 (2 days ago)	(mod_security) mod_security (id:211220) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkusch ... show more (mod_security) mod_security (id:211220) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 12:26:30.982022 2026] [security2:error] [pid 25818:tid 25818] [client 2605:6400:30:f174::42:11157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|ggisoftware.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ggisoftware.com"] [uri "/index.php"] [unique_id "akFLNrd3dAn8-9AnosoS0gAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-06-25 15:14:23 (5 days ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-19 17:03:31 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkusch ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 13:03:24.017886 2026] [security2:error] [pid 15144:tid 15144] [client 2605:6400:30:f174::42:50077] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|astglobalgroup.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "astglobalgroup.com"] [uri "/tglobalgroup_wp1.sql"] [unique_id "ajV2XCS-lVKcdsLKmqcTlQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-24 02:10:51 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 21991 Packet length: 80 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 8333) Source port: 21991 Packet length: 80 This report (for 2605:6400:0030:f174:0000:0000:0000:0042) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-06 19:17:02 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkusch ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 15:16:57.036619 2026] [security2:error] [pid 28904:tid 28904] [client 2605:6400:30:f174::42:60271] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bluemarineboats.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bluemarineboats.com"] [uri "/backupdb.sql"] [unique_id "afuTqbzxqFJaLjKzfCdfZgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 HandyTreff.de	2026-04-27 09:28:09 (2 months ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -49.875 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -49.875 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.10 show less	Web App Attack Bad Web Bot
Anonymous	2026-04-26 21:02:26 (2 months ago)	2026-04-26 08:00:32,380 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174::42 2026 ... show more 2026-04-26 08:00:32,380 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174::42 2026-04-26 12:01:28,571 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174::42 2026-04-26 18:01:26,384 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174::42 2026-04-26 21:01:23,554 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174::42 2026-04-27 00:02:25,320 fail2ban.actions [7718]: NOTICE [tor] Ban 2605:6400:30:f174::42 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-02 03:53:16 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkusch ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 23:53:10.912715 2026] [security2:error] [pid 25752:tid 25752] [client 2605:6400:30:f174::42:12453] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|atmoorehealthcare.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atmoorehealthcare.com"] [uri "/ehealthcare_com.sql"] [unique_id "ac3oJkXg1lSZt3VP2OkI4AAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ketovoila.pl	2026-04-01 19:38:11 (2 months ago)	ketovoila.pl HONEYPOT traffic: count=1, paths=1; sample_path=ketovoila.pl/ketovoil.sql; UA=Mozilla/5 ... show more ketovoila.pl HONEYPOT traffic: count=1, paths=1; sample_path=ketovoila.pl/ketovoil.sql; UA=Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1; window=2026-04-01T18:56:00Z..2026-04-01T18:56:00Z show less	Port Scan Hacking Brute-Force
🇮🇹 VHosting	2026-03-26 20:10:59 (3 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 xmission.com	2026-03-09 15:05:04 (3 months ago)	Blocked by UFW (TCP on 9999) Source port: 28741 Packet length: 80 This report (for 2605:6400:0030:f ... show more Blocked by UFW (TCP on 9999) Source port: 28741 Packet length: 80 This report (for 2605:6400:0030:f174:0000:0000:0000:0042) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Ping of Death
🇺🇸 TPI-Abuse	2026-03-04 13:56:25 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkusch ... show more (mod_security) mod_security (id:210730) triggered by 2605:6400:30:f174::42 (polyphemus8.brandonkuschel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 08:56:19.886359 2026] [security2:error] [pid 30023:tid 30023] [client 2605:6400:30:f174::42:54743] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|forerunnersjazz.org\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "forerunnersjazz.org"] [uri "/nersjazz_db.sql"] [unique_id "aag6AymPJ-fipVS5Rtk_TgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 84 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a880:2:d1:0:1:51e6:7001

🇨🇳 223.104.195.72

🇮🇩 202.51.202.242

🇧🇷 187.19.159.35

🇺🇸 185.223.152.220

🇧🇩 151.158.48.106

🇹🇼 104.199.176.250

🇨🇦 85.217.149.24

🇺🇸 45.33.105.76

🇺🇸 137.184.190.194

🇰🇷 119.207.3.114

🇺🇸 113.20.0.58

🇳🇱 91.92.40.13

🇳🇱 45.148.10.151

🇫🇷 13.140.173.103

🇰🇷 222.108.100.117

🇬🇧 185.247.137.72

🇬🇧 185.247.137.46

🇺🇸 185.223.152.109

🇨🇳 183.14.91.20