JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a01:4f8:1c1c:3ca2::1

2a01:4f8:1c1c:3ca2::1 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 63%: ?

63%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Hetzner Online GmbH
Usage Type	Content Delivery Network
ASN	AS24940
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a01:4f8:1c1c:3ca2::1

Whois 2a01:4f8:1c1c:3ca2::1

IP Abuse Reports for 2a01:4f8:1c1c:3ca2::1:

This IP address has been reported a total of 14 times from 10 distinct sources. 2a01:4f8:1c1c:3ca2::1 was first reported on August 19th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇰 ScamAware	2026-08-21 15:03:37 (3 hours ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 4. Unique request paths counted internally: 4. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Web App Attack
🇨🇦 zXero	2026-08-21 11:52:12 (6 hours ago)	Fail2Ban automatic report - jail: web-exploit	Brute-Force SSH DDoS Attack
Anonymous	2026-08-21 07:50:52 (10 hours ago)	Automated scraper: solved anti-bot JS/Turnstile challenge via residential proxy, then crawled produc ... show more Automated scraper: solved anti-bot JS/Turnstile challenge via residential proxy, then crawled product pages without loading any page assets (CSS/JS/images) - consistent with headless scripted access rather than a real browser session. show less	Bad Web Bot Web App Attack
🇺🇸 Penny Packer	2026-08-21 07:25:26 (11 hours ago)	Fail2Ban apache-404	Web App Attack
🇺🇸 helios.live	2026-08-21 07:18:19 (11 hours ago)	2026/08/21 07:18:16 [error] 1524000#1524000: 537850 FastCGI sent in stderr: "Primary script unknown ... show more 2026/08/21 07:18:16 [error] 1524000#1524000: 537850 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 2a01:4f8:1c1c:3ca2::1, server: kocerroxy.com, request: "POST /register/api_jsonrpc.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "app.kocerroxy.com" 2a01:4f8:1c1c:3ca2::1 - - [21/Aug/2026:07:18:16 +0000] "POST /register/api_jsonrpc.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 2026/08/21 07:18:16 [error] 1524000#1524000: *537850 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 2a01:4f8:1c1c:3ca2::1, server: kocerroxy.com, request: "GET /register/admin/index.php?route=common/login HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "app.kocerroxy.com" 2a01:4f8:1c1c:3ca2::1 - - [21/Aug/2026:07:18:16 +0000] "GET /r ... show less	Web App Attack
🇺🇸 ipblock.com	2026-08-21 04:43:00 (13 hours ago)	IPBlock protected site ID [3717-sec]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-08-21 02:54:57 (15 hours ago)	Malformed or malicious web request 2a01:4f8:1c1c:3ca2::1 - - [21/Aug/2026:04:54:54 +0200] "POST /j_s ... show more Malformed or malicious web request 2a01:4f8:1c1c:3ca2::1 - - [21/Aug/2026:04:54:54 +0200] "POST /j_spring_security_check HTTP/1.1" 404 12717 "https://forum.<REDACTED>/login" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇮🇩 soc-yk	2026-08-20 16:30:15 (1 day ago)	Type: suspicious_network_activity Risk: 89 Events: 52 Evidence: - Persistent suspicious network act ... show more Type: suspicious_network_activity Risk: 89 Events: 52 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇮🇩 soc-yk	2026-08-20 15:42:12 (1 day ago)	Type: web_scanning Risk: 89 Events: 52 Evidence: - Automated hostile web probing detected - Repeate ... show more Type: web_scanning Risk: 89 Events: 52 Evidence: - Automated hostile web probing detected - Repeated web scanning activity observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Web App Attack
🇨🇦 Not Fake	2026-08-20 01:24:54 (1 day ago)	$f2bV_matches	Web App Attack
🇺🇸 ipblock.com	2026-08-20 00:42:00 (1 day ago)	IPBlock protected site ID [3717-sec]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-08-19 20:08:35 (1 day ago)	Malformed or malicious web request 2a01:4f8:1c1c:3ca2::1 - - [19/Aug/2026:22:08:33 +0200] "POST /j_s ... show more Malformed or malicious web request 2a01:4f8:1c1c:3ca2::1 - - [19/Aug/2026:22:08:33 +0200] "POST /j_spring_security_check HTTP/1.1" 404 12717 "https://forum.<REDACTED>/login" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇮🇹 VHosting	2026-08-19 14:45:03 (2 days ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇩🇰 ScamAware	2026-08-19 14:32:50 (2 days ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 6. Unique request paths counted internally: 5. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇴 209.198.156.49

🇩🇪 194.99.110.96

🇮🇳 106.51.92.114

🇰🇭 103.101.158.215

🇷🇺 91.144.158.62

🇺🇸 38.126.98.90

🇰🇷 222.107.156.227

🇫🇮 147.185.133.192

🇺🇸 107.148.160.228

🇺🇸 72.23.144.234

🇺🇸 68.195.148.32

🇺🇸 49.51.228.208

🇰🇪 41.90.65.215

🇺🇸 35.237.99.168

🇺🇸 2601:410:8282:ce0:21e6:856e:64a5:36fc

🇺🇸 2600:6c56:9400:182:b09f:f907:8cef:2cf3

🇧🇪 198.235.24.206

🇸🇪 195.178.191.5

🇳🇱 193.47.62.69

🇷🇴 193.46.255.86