JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2607:f298:5:114b::656:e1c6

2607:f298:5:114b::656:e1c6 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 87%: ?

87%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	DreamHost
Usage Type	Data Center/Web Hosting/Transit
ASN	AS26347
Hostname(s)	lfe.fit
Domain Name	dreamhost.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2607:f298:5:114b::656:e1c6

Whois 2607:f298:5:114b::656:e1c6

IP Abuse Reports for 2607:f298:5:114b::656:e1c6:

This IP address has been reported a total of 34 times from 16 distinct sources. 2607:f298:5:114b::656:e1c6 was first reported on August 31st 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 alferez	2026-09-03 04:47:47 (12 hours ago)	wp2shell bug exploit	Hacking Exploited Host Web App Attack
🇫🇷 LRob	2026-09-02 15:13:30 (1 day ago)	Enumerating paths that do not exist (scanning) \| method: GET (+1 more) \| path: / (+3 more) \| 2026-09 ... show more Enumerating paths that do not exist (scanning) \| method: GET (+1 more) \| path: / (+3 more) \| 2026-09-02 15:13 UTC show less	Port Scan Web App Attack
🇳🇱 homeshowdomain.nl	2026-09-01 21:59:16 (1 day ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-31. show less	Web App Attack SSH Hacking
🇺🇸 thezelijah	2026-09-01 18:00:52 (1 day ago)	[AI Threat Score: 77/100] [AbuseIPDB Score: 77] The IP address 2607:f298:5:114b::656:e1c6 originatin ... show more [AI Threat Score: 77/100] [AbuseIPDB Score: 77] The IP address 2607:f298:5:114b::656:e1c6 originating from DreamHost targeted the root endpoint GET / and triggered a nonexistent-endpoint rule. This local activity aligns with a significant external reputation profile comprising 30 total reports, with the most recent external report occurring just hours prior at 2026-09-01T09:12:34.000Z. Likely motive: Automated scanning or malicious probing activity. show less	Hacking Web App Attack Port Scan
🇺🇸 distorx	2026-09-01 09:12:34 (2 days ago)	[01/Sep/2026:09:12:33 +0000] 200 - GET http www.distorx.com "/" [Client 2607:f298:5:114b::656:e1c6] ... show more [01/Sep/2026:09:12:33 +0000] 200 - GET http www.distorx.com "/" [Client 2607:f298:5:114b::656:e1c6] [Length 1033] [Gzip -] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" "-" ... show less	Port Scan Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-31 16:19:10 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 12:19:03.286341 2026] [security2:error] [pid 17443:tid 17443] [client 2607:f298:5:114b::656:e1c6:50286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "midway-island.com"] [uri "/.git/config"] [unique_id "apWpdz5V3ETs4nhgUgr6rwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-08-31 15:33:16 (3 days ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /.git/config \| 2026-08-31 15:33 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 15:13:34 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 11:13:27.370382 2026] [security2:error] [pid 15988:tid 15988] [client 2607:f298:5:114b::656:e1c6:58618] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gevieworld.com"] [uri "/.git/config"] [unique_id "apWaF1jnro5387IPYftuAQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 14:44:02 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 10:43:54.794459 2026] [security2:error] [pid 21300:tid 21300] [client 2607:f298:5:114b::656:e1c6:52512] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.seoanalyticslocal.com"] [uri "/.git/config"] [unique_id "apWTKnQa_xw_zmHb4bLZOQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 nate naten	2026-08-31 14:26:58 (3 days ago)	HoneyTrap: git_config attempt on /.git/config from United States	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 14:19:26 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 10:19:22.773624 2026] [security2:error] [pid 8587:tid 8587] [client 2607:f298:5:114b::656:e1c6:59312] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.battleprides.tracybur.net"] [uri "/.git/config"] [unique_id "apWNakXXyNE4qtPotjVaMgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 13:15:30 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 09:15:23.552401 2026] [security2:error] [pid 5808:tid 5808] [client 2607:f298:5:114b::656:e1c6:44446] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "taller.verdeprofundo.net"] [uri "/.git/config"] [unique_id "apV-a33D5XaxyaUdVzGa9AAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 12:49:45 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 08:49:40.913229 2026] [security2:error] [pid 18503:tid 18503] [client 2607:f298:5:114b::656:e1c6:60798] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.archaiusmusic.protonmultimedia.com"] [uri "/.git/config"] [unique_id "apV4ZBaVTt0GFEeecYVtBgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 11:07:28 (3 days ago)	(mod_security) mod_security (id:949110) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:949110) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 07:07:23.538368 2026] [security2:error] [pid 28700:tid 28700] [client 2607:f298:5:114b::656:e1c6:60588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.letahaabooking.com"] [uri "/.git/config"] [unique_id "apVga1k9jvzBi_n6FgiQ1AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 10:49:55 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the ... show more (mod_security) mod_security (id:210492) triggered by 2607:f298:5:114b::656:e1c6 (lfe.fit): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 06:49:48.375774 2026] [security2:error] [pid 11713:tid 11713] [client 2607:f298:5:114b::656:e1c6:59624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.hotelparticulier.fritsknuf.com"] [uri "/.git/config"] [unique_id "apVcTDwXcrXmHuuRoCDobwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 184.105.139.76

🇻🇳 171.231.184.246

🇺🇸 96.126.101.34

🇰🇬 91.192.64.133

🇵🇱 77.45.43.16

🇩🇪 64.226.66.59

🇫🇮 45.87.249.146

🇩🇪 43.228.157.8

🇹🇼 2400:cb00:80:1000:3c23:1a11:9bfa:78ff

🇧🇷 143.255.20.82

🇺🇸 138.199.35.219

🇹🇭 125.25.79.129

🇧🇩 118.179.93.12

🇹🇭 101.109.77.90

🇩🇪 80.187.126.166

🇫🇮 74.125.74.29

🇺🇸 73.192.193.46

🇿🇲 45.215.234.195

🇨🇦 212.32.48.83

🇦🇷 190.92.100.57