JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a01:4f8:c012:9160::1

2a01:4f8:c012:9160::1 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 68%: ?

68%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Hetzner Online GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Domain Name	hetzner.com
Country	🇩🇪 Germany
City	Falkenstein, Saxony

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a01:4f8:c012:9160::1

Whois 2a01:4f8:c012:9160::1

IP Abuse Reports for 2a01:4f8:c012:9160::1:

This IP address has been reported a total of 18 times from 13 distinct sources. 2a01:4f8:c012:9160::1 was first reported on September 12th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-13 21:59:36 (4 days ago)	Auto-ban: 205 malicious requests on 2026-09-12 (e.g., env/backup probes, brute-force, or error burst ... show more Auto-ban: 205 malicious requests on 2026-09-12 (e.g., env/backup probes, brute-force, or error bursts). show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-09-13 06:49:48 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 02:49:43.128879 2026] [security2:error] [pid 20178:tid 20178] [client 2a01:4f8:c012:9160::1:33714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staben.com"] [uri "/wp-config.php.bak"] [unique_id "aqZHhyMG0Iau6cqa6zrEdwAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 03:35:53 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 23:35:46.419067 2026] [security2:error] [pid 16174:tid 16192] [client 2a01:4f8:c012:9160::1:49984] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "testproperty.pref-realestate.com"] [uri "/wp-config.php.bak"] [unique_id "aqYaEpHbDbVLEtWSz80jYwAAAFE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 03:03:24 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 23:03:19.824180 2026] [security2:error] [pid 8827:tid 8836] [client 2a01:4f8:c012:9160::1:56526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "conservativedemocrat.com"] [uri "/wp-config.php.bak"] [unique_id "aqYSd5v4T5Cit040DnYJ7wAAAIc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-13 00:56:41 (5 days ago)	[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2a01:4f8:c012:9160::1 - - [13/Sep/2026:02:56:40 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 30573 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-12 23:20:10 (5 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇮 as211431.net	2026-09-12 18:17:15 (5 days ago)	Triggered Cloudflare WAF (linkMaze) from DE. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (GE ... show more Triggered Cloudflare WAF (linkMaze) from DE. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇦🇺 2000cn.com.au	2026-09-12 18:11:19 (5 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-probing	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-09-12 17:44:51 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 13:44:42.904310 2026] [security2:error] [pid 25579:tid 25597] [client 2a01:4f8:c012:9160::1:39940] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.iamfluff.com"] [uri "/wp-config.php.bak"] [unique_id "aqWPiq8ihKSXqMP_8VgUogAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Mehmet_The_Script_Kiddie	2026-09-12 15:26:42 (5 days ago)	CloudFlare WAF REPORT: Disobey robots.txt. Suspicious web crawler.	Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-12 13:58:13 (5 days ago)	Enumerating paths that do not exist (scanning) \| method: GET \| path: /api/session/properties \| ua: m ... show more Enumerating paths that do not exist (scanning) \| method: GET \| path: /api/session/properties \| ua: metabase-cve-2026-72898-detect/1.0 (benign detection probes only) \| 2026-09-12 13:58 UTC show less	Port Scan Web App Attack
🇳🇱 Roderic	2026-09-12 13:56:51 (5 days ago)	Port Scan detected from 2a01:4f8:c012:9160::1 (DE/Germany/Saxony/Falkenstein/-/[redacted]).	Port Scan
🇺🇸 TPI-Abuse	2026-09-12 13:44:16 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a01:4f8:c012:9160::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 09:44:10.001427 2026] [security2:error] [pid 3489520:tid 3489520] [client 2a01:4f8:c012:9160::1:57822] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dynamic-therapy-mn.com"] [uri "/wp-config.php.bak"] [unique_id "aqVXKnvBGskzb9o5FnafjQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 yitzhaq	2026-09-12 11:38:06 (6 days ago)	2a01:4f8:c012:9160::1 - - [12/Sep/2026:13:37:39 +0200] "GET / HTTP/1.1" 503 8352 "-" "Mozilla/5.0 (W ... show more 2a01:4f8:c012:9160::1 - - [12/Sep/2026:13:37:39 +0200] "GET / HTTP/1.1" 503 8352 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a01:4f8:c012:9160::1 - - [12/Sep/2026:13:37:50 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 403 4489 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a01:4f8:c012:9160::1 - - [12/Sep/2026:13:38:01 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 403 4489 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a01:4f8:c012:9160::1 - - [12/Sep/2026:11:13:40 +0200] "GET / HTTP/1.1" 301 4745 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" show less	Web App Attack Hacking
🇵🇹 WebTejo	2026-09-12 11:29:50 (6 days ago)	Detected multiple authentication failures and invalid user attempts in PS_LIMIT from IP address 2a01 ... show more Detected multiple authentication failures and invalid user attempts in PS_LIMIT from IP address 2a01:4f8:c012:9160::1 on [PT] Tucano Node. show less	Brute-Force SSH

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 199.241.120.131

🇫🇷 85.217.140.50

🇱🇹 62.60.130.253

🇳🇱 195.178.110.227

🇸🇪 195.128.241.226

🇧🇷 179.131.224.140

🇭🇰 156.225.1.98

🇩🇪 139.59.133.58

🇩🇪 130.12.180.117

🇨🇳 101.96.195.62

🇬🇧 81.19.219.203

🇺🇸 65.49.20.87

🇳🇱 45.148.10.151

🇬🇧 35.203.210.225

🇦🇺 27.33.47.92

🇦🇺 216.226.77.10

🇫🇷 209.242.192.2

🇧🇩 202.181.16.250

🇮🇶 151.236.178.196

🇨🇳 58.58.122.14