JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a00:1911:1:e656:16de:202e:63bc:c31f

2a00:1911:1:e656:16de:202e:63bc:c31f was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Layer7 Networks GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS35042
Domain Name	layer7.net
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a00:1911:1:e656:16de:202e:63bc:c31f

Whois 2a00:1911:1:e656:16de:202e:63bc:c31f

IP Abuse Reports for 2a00:1911:1:e656:16de:202e:63bc:c31f:

This IP address has been reported a total of 30 times from 19 distinct sources. 2a00:1911:1:e656:16de:202e:63bc:c31f was first reported on August 30th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-09-03 15:50:57 (9 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇧🇪 cmbplf	2026-09-03 14:05:51 (11 hours ago)	13.309 requests from abuseipdb.com blacklisted IP (5mos3w9h)	Brute-Force Bad Web Bot
🇩🇪 MarkGGN	2026-09-03 04:33:40 (20 hours ago)	Web attack. 2a00:1911:1:e656:16de:202e:63bc:c31f - - [03/Sep/2026:06:33:40 +0200] "GET /.vscode/sftp ... show more Web attack. 2a00:1911:1:e656:16de:202e:63bc:c31f - - [03/Sep/2026:06:33:40 +0200] "GET /.vscode/sftp.json HTTP/1.1" 404 717 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" show less	Web App Attack
🇪🇸 alferez	2026-09-03 04:22:56 (21 hours ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 06:16:49 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 2a00:1911:1:e656:16de:202e:63bc:c31f (Unknown): ... show more (mod_security) mod_security (id:210492) triggered by 2a00:1911:1:e656:16de:202e:63bc:c31f (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:16:37.045460 2026] [security2:error] [pid 4663:tid 4663] [client 2a00:1911:1:e656:16de:202e:63bc:c31f:65256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rnance.com"] [uri "/sftp-config.json"] [unique_id "apZtxRIZlnq0BbWXBaybKQAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 S.O.B.A. Dev.	2026-09-01 00:55:31 (3 days ago)	Web vulnerability scanning	Brute-Force Web Spam Web App Attack
🇺🇸 dtorrer	2026-08-31 23:10:08 (3 days ago)	Brute-force general attack.	Brute-Force
🇳🇱 Mangelot Hosting	2026-08-31 23:04:14 (3 days ago)	(upload_shell) srv102 PHP Shell Upload 2a00:1911:1:e656:16de:202e:63bc:c31f (DE/Germany/-): 1 in the ... show more (upload_shell) srv102 PHP Shell Upload 2a00:1911:1:e656:16de:202e:63bc:c31f (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇳🇱 Site.eu	2026-08-31 22:06:34 (3 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-08-31 19:11:34 (3 days ago)	2026-08-31T19:11:34.327193+00:00 instance-20260804-1025 wordpress(netal.co)[1127220]: Blocked user e ... show more 2026-08-31T19:11:34.327193+00:00 instance-20260804-1025 wordpress(netal.co)[1127220]: Blocked user enumeration attempt from 2a00:1911:1:e656:16de:202e:63bc:c31f ... show less	Web App Attack
🇳🇱 Savvii	2026-08-31 17:22:26 (3 days ago)	10 attempts against mh-misc-ban on redirect	Web App Attack
🇺🇸 bigwavedave	2026-08-31 17:05:13 (3 days ago)	Wordpress Attack	Web App Attack
🇩🇪 MarkGGN	2026-08-31 12:43:11 (3 days ago)	Web attack. 2a00:1911:1:e656:16de:202e:63bc:c31f - - [31/Aug/2026:14:43:10 +0200] "GET /.vscode/sftp ... show more Web attack. 2a00:1911:1:e656:16de:202e:63bc:c31f - - [31/Aug/2026:14:43:10 +0200] "GET /.vscode/sftp.json HTTP/1.1" 404 717 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" 2a00:1911:1:e656:16de:202e:63bc:c31f - - [31/Aug/2026:14:43:10 +0200] "GET /sftp-config.json HTTP/1.1" 404 754 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" show less	Web App Attack
🇪🇸 el-brujo	2026-08-31 11:50:20 (3 days ago)	31/Aug/2026:13:50:19.525476 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 31/Aug/2026:13:50:19.525476 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 2a00:1911:1:e656:16de:202e:63bc:c31f] ModSecurity: Warning. Matched phrase "/sftp-config.json" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "hostench.eu"] [uri "/sftp-config.json"] [unique_id "apVqe6Dp6trBUlWEcSyY8QAS-HM"] ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 11:42:11 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a00:1911:1:e656:16de:202e:63bc:c31f (Unknown): ... show more (mod_security) mod_security (id:210492) triggered by 2a00:1911:1:e656:16de:202e:63bc:c31f (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 07:42:05.846257 2026] [security2:error] [pid 28521:tid 28521] [client 2a00:1911:1:e656:16de:202e:63bc:c31f:50066] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aifactoid.com"] [uri "/sftp-config.json"] [unique_id "apVojaLY-MczOEP271-WjQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 119.117.74.66

🇫🇷 2001:861:34c1:93c0:86bc:8d70:fa0e:3a9d

🇧🇪 198.235.24.202

🇳🇱 195.178.110.30

🇩🇪 193.124.20.230

🇹🇷 176.53.35.188

🇰🇷 146.56.103.89

🇺🇸 137.184.54.235

🇰🇷 112.161.64.234

🇺🇸 91.230.168.241

🇷🇴 89.32.41.43

🇨🇦 85.217.149.66

🇺🇸 71.214.223.96

🇩🇪 69.5.169.206

🇺🇸 57.141.20.56

🇿🇲 41.173.43.34

🇫🇷 2001:41d0:33a:a00::409

🇰🇿 188.247.202.76

🇳🇱 185.107.80.93

🇰🇷 121.131.220.136