JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2605:7980:0:64f6::1

2605:7980:0:64f6::1 was found in our database!

This IP was reported 124 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	RouterHosting LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14956
Domain Name	cloudzy.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2605:7980:0:64f6::1

Whois 2605:7980:0:64f6::1

IP Abuse Reports for 2605:7980:0:64f6::1:

This IP address has been reported a total of 124 times from 67 distinct sources. 2605:7980:0:64f6::1 was first reported on July 5th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 retrokitty.net	2026-08-28 16:20:52 (3 hours ago)	2605:7980:0:64f6::1 - - [28/Aug/2026:16:20:51 +0000] "GET /.env HTTP/1.1" 503 23480 "-" "Mozilla/5.0 ... show more 2605:7980:0:64f6::1 - - [28/Aug/2026:16:20:51 +0000] "GET /.env HTTP/1.1" 503 23480 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Web App Attack
🇫🇷 LRob	2026-08-28 12:39:35 (7 hours ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /.env \| 2026-08-28 12:39 UTC show less	Hacking Web App Attack
🇩🇰 ScamAware	2026-08-28 12:06:13 (7 hours ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 1. Unique request paths counted internally: 1. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Web App Attack
Anonymous	2026-08-28 11:48:12 (8 hours ago)	Automated honeypot detection on bbd.fan: probed /.env \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 1 ... show more Automated honeypot detection on bbd.fan: probed /.env \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 show less	Web App Attack Hacking
🇩🇪 conseilgouz	2026-08-28 10:59:02 (8 hours ago)	ave-17 : Block hidden directories=>/.env(/)	Hacking
🇺🇸 TPI-Abuse	2026-08-28 10:41:49 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 06:41:42.844174 2026] [security2:error] [pid 20413:tid 20413] [client 2605:7980:0:64f6::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "swarnar.com"] [uri "/.env"] [unique_id "apFl5jECp6JvaSelwsJ3uwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 wpadm4	2026-08-28 10:26:28 (9 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-08-28 10:22:34 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 06:22:25.649418 2026] [security2:error] [pid 29789:tid 29913] [client 2605:7980:0:64f6::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "raytbrown.com"] [uri "/.env"] [unique_id "apFhYX6seQRxpYKlqhY_7AAAAJY"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Aetherweb Ark	2026-08-28 08:55:04 (11 hours ago)	(mod_security) mod_security (id:949110) triggered by 2605:7980:0:64f6::1 (Unknown): N in the last X ... show more (mod_security) mod_security (id:949110) triggered by 2605:7980:0:64f6::1 (Unknown): N in the last X secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-28 08:42:34 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 04:42:28.113252 2026] [security2:error] [pid 1831:tid 1831] [client 2605:7980:0:64f6::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pixacast.com"] [uri "/.env"] [unique_id "apFJ9M8CSMu5Dl1syYB9fgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-28 08:25:27 (11 hours ago)	http scanning for .env files ...	Hacking Web App Attack
Anonymous	2026-08-28 08:19:35 (11 hours ago)	2605:7980:0:64f6::1 - - [28/Aug/2026:05:19:28 -0300] "GET /.env HTTP/1.1" 403 829 "-" "Mozilla/5.0 ( ... show more 2605:7980:0:64f6::1 - - [28/Aug/2026:05:19:28 -0300] "GET /.env HTTP/1.1" 403 829 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 2605:7980:0:64f6::1 - - [28/Aug/2026:05:19:34 -0300] "GET /.env HTTP/1.1" 403 829 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Port Scan
🇺🇸 TPI-Abuse	2026-08-28 08:01:51 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2605:7980:0:64f6::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 04:01:45.569723 2026] [security2:error] [pid 8356:tid 8382] [client 2605:7980:0:64f6::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindgardens.com"] [uri "/.env"] [unique_id "apFAab8tTSbLyDxbQDNfmwAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 dtorrer	2026-08-28 07:14:17 (12 hours ago)	General vulnerability scan.	Port Scan
🇺🇸 www.winos.me	2026-08-28 06:28:00 (13 hours ago)	Scanning for sensitive files/paths: /.env	Hacking Web App Attack

Showing 1 to 15 of 124 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 104.22.10.186

🇫🇷 91.231.89.133

🇺🇸 34.41.20.22

🇱🇹 213.176.26.153

🇳🇱 193.47.62.69

🇳🇱 34.12.167.78

🇹🇭 203.154.158.195

🇺🇿 195.158.11.140

🇳🇱 185.234.9.185

🇳🇱 178.62.233.127

🇸🇪 171.25.158.68

🇺🇸 167.148.33.215

🇺🇸 162.144.20.85

🇫🇷 152.228.143.237

🇨🇳 117.81.84.98

🇺🇸 66.99.48.136

🇩🇪 54.93.188.58

🇫🇮 37.27.129.137

🇷🇺 5.142.212.170

🇺🇸 4.148.240.210