JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a01:4f8:1c19:a57f::1

2a01:4f8:1c19:a57f::1 was found in our database!

This IP was reported 81 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a01:4f8:1c19:a57f::1

Whois 2a01:4f8:1c19:a57f::1

IP Abuse Reports for 2a01:4f8:1c19:a57f::1:

This IP address has been reported a total of 81 times from 48 distinct sources. 2a01:4f8:1c19:a57f::1 was first reported on July 3rd 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-10 00:48:53 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 20:48:48.982800 2026] [security2:error] [pid 5822:tid 5822] [client 2a01:4f8:1c19:a57f::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.env"] [unique_id "alBBcJ6P9-cfPUdm_nTJ7wAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Ba-Yu	2026-07-10 00:30:17 (3 weeks ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇫🇷 LRob	2026-07-10 00:29:31 (3 weeks ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/secrets.json","/.env.backup","/.git/HEAD","/. ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/secrets.json","/.env.backup","/.git/HEAD","/.env.local","/.aws/credentials"] \| UA: ["Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; W show less	Hacking
🇩🇪 Skyrider	2026-07-10 00:21:21 (3 weeks ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-07-10 00:20:11 (3 weeks ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇩🇪 gadix	2026-07-08 15:05:10 (3 weeks ago)	[08/Jul/2026:17:05:04.673142 +0200] ak5nINmLlbxJHxQKql072QAAAFQ 2a01:4f8:1c19:a57f::1 46410 127.0.0. ... show more [08/Jul/2026:17:05:04.673142 +0200] ak5nINmLlbxJHxQKql072QAAAFQ 2a01:4f8:1c19:a57f::1 46410 127.0.0.1 7081 [08/Jul/2026:17:05:04.674031 +0200] ak5nINmLlbxJHxQKql072gAAAFA 2a01:4f8:1c19:a57f::1 46414 127.0.0.1 7081 [08/Jul/2026:17:05:04.677595 +0200] ak5nIBUjjfC8AKqu5F8_ewAAAJQ 2a01:4f8:1c19:a57f::1 46430 127.0.0.1 7081 ... show less	Web App Attack
🇩🇪 pltcldvlpr	2026-07-08 05:40:36 (3 weeks ago)	CMS/framework probe: 2a01:4f8:1c19:a57f::1 - - [08/Jul/2026:07:40:35 +0200] "HEAD /.git/config HTTP/ ... show more CMS/framework probe: 2a01:4f8:1c19:a57f::1 - - [08/Jul/2026:07:40:35 +0200] "HEAD /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" asn=24940 org="Hetzner Online GmbH" country=DE ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 04:03:58 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 00:03:54.576413 2026] [security2:error] [pid 11204:tid 11204] [client 2a01:4f8:1c19:a57f::1:53318] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.k-h-w.com"] [uri "/wp-config.php.bak"] [unique_id "ak3MKum0TcNdCLQHXazXAgAAABk"], referer: https://www.google.com/search?q=cpcalendars.k-h-w.com show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-07-08 03:28:02 (3 weeks ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 ipoac.nl	2026-07-07 15:44:10 (3 weeks ago)	-:443 2a01:4f8:1c19:a57f::1 - - [07/Jul/2026:17:44:09 +0200] - "HEAD /.git/HEAD HTTP/1.1" 403 4932 " ... show more -:443 2a01:4f8:1c19:a57f::1 - - [07/Jul/2026:17:44:09 +0200] - "HEAD /.git/HEAD HTTP/1.1" 403 4932 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" show less	Bad Web Bot
🇵🇱 Niko's Stuff	2026-07-07 14:16:56 (3 weeks ago)	Triggered crowdsecurity/http-sensitive-files. More information at: https://app.crowdsec.net/cti/2a01 ... show more Triggered crowdsecurity/http-sensitive-files. More information at: https://app.crowdsec.net/cti/2a01:4f8:1c19:a57f::1 show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-07-07 13:42:50 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 09:42:46.604781 2026] [security2:error] [pid 564:tid 564] [client 2a01:4f8:1c19:a57f::1:8776] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.straypointers.com"] [uri "/.env.production"] [unique_id "ak0CVlvOXoeSaUOlSyRsAAAAAA0"], referer: https://www.google.com/search?q=www.straypointers.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 12:38:00 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 08:37:55.760457 2026] [security2:error] [pid 3878:tid 3878] [client 2a01:4f8:1c19:a57f::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kidswithcamerasmovie.com"] [uri "/.env"] [unique_id "akzzIxry_pWZ9CV5IR4EpwAAAAY"], referer: https://www.google.com/search?q=kidswithcamerasmovie.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 02:33:35 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 22:33:28.713562 2026] [security2:error] [pid 15868:tid 15868] [client 2a01:4f8:1c19:a57f::1:29516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pnalegacypartners.com"] [uri "/.env"] [unique_id "aksT-PUj26EyqvPEjgkVkwAAAAI"], referer: https://www.google.com/search?q=pnalegacypartners.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 01:40:52 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:1c19:a57f::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 21:40:47.387231 2026] [security2:error] [pid 22097:tid 22097] [client 2a01:4f8:1c19:a57f::1:15072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dcmillerjr.com"] [uri "/wp-config.php.bak"] [unique_id "aksHn2SRaV-dlX4Jg179BQAAABM"], referer: https://www.google.com/search?q=autodiscover.dcmillerjr.com show less	Brute-Force Bad Web Bot Web App Attack

Showing 46 to 60 of 81 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 218.166.96.45

🇰🇪 196.207.154.157

🇺🇸 162.216.149.157

🇯🇵 152.32.202.151

🇫🇷 91.196.152.247

🇹🇷 78.135.83.132

🇸🇬 47.79.201.85

🇺🇦 46.150.72.195

🇮🇳 122.187.228.228

🇷🇺 95.165.27.83

🇳🇱 46.29.25.111

🇳🇱 45.148.10.157

🇧🇷 205.210.31.254

🇵🇱 176.53.159.198

🇪🇸 158.158.32.226

🇭🇰 152.32.186.240

🇺🇸 147.185.132.61

🇱🇹 141.98.11.224

🇨🇳 120.39.36.87

🇵🇰 103.82.120.61