JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a01:4f9:4a:2aa5::2

2a01:4f9:4a:2aa5::2 was found in our database!

This IP was reported 812 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Marcus Bauer
Usage Type	Data Center/Web Hosting/Transit
ASN	AS24940
Domain Name	hetzner.com
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a01:4f9:4a:2aa5::2

Whois 2a01:4f9:4a:2aa5::2

IP Abuse Reports for 2a01:4f9:4a:2aa5::2:

This IP address has been reported a total of 812 times from 93 distinct sources. 2a01:4f9:4a:2aa5::2 was first reported on September 4th 2022, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 PTScreens	2026-08-22 00:23:59 (5 hours ago)	CrowdSec: http-bad-user-agent - 2 event(s).	Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-08-21 17:23:45 (12 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent	Web App Attack Bad Web Bot
🇩🇪 Hazzard	2026-08-21 14:52:17 (14 hours ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted]): (CF_ENABLE)	Bad Web Bot
🇵🇱 Budyn	2026-08-21 13:52:30 (15 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: panel.sweetpuddingtrap.xyz \| URI: /backup.sql \| UA: Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/) \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 LRob	2026-08-21 02:12:00 (1 day ago)	Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5 ... show more Abusive crawler: User-Agent on the known-bad list or claiming a placeholder identity \| ua: Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/) \| path: /robots.txt show less	Bad Web Bot
🇵🇱 Budyn	2026-08-20 23:33:03 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sql.definitelynotahoneypot.top \| URI: /backup.sql \| UA: Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/) \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-20 18:04:40 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 www.winos.me	2026-08-20 15:19:00 (1 day ago)	Malicious bot scraper	Port Scan Bad Web Bot
🇩🇪 TheDjRider	2026-08-20 04:33:16 (2 days ago)	CrowdSec detected Malicious web crawler or bad web bot. Scenario: crowdsecurity/http-bad-user-agent. ... show more CrowdSec detected Malicious web crawler or bad web bot. Scenario: crowdsecurity/http-bad-user-agent. Automatic ban triggered. Detection time (UTC): 2026-08-20T04:33:12.694089562Z. Context: http_status=200 show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-08-20 03:07:54 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: staging.sweetpuddingtrap.top \| URI: /backup.sql \| UA: Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/) \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-08-19 15:54:18 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: docker.astropot.online \| URI: /backup.sql \| UA: Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/) \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇬🇧 Mendip_Defender	2026-08-19 03:15:24 (3 days ago)	2a01:4f9:4a:2aa5::2 - - [19/Aug/2026:04:15:32 +0100] "GET /robots.txt HTTP/2.0" 403 86 "-" "Mozilla/ ... show more 2a01:4f9:4a:2aa5::2 - - [19/Aug/2026:04:15:32 +0100] "GET /robots.txt HTTP/2.0" 403 86 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)" ... show less	Bad Web Bot
🇺🇸 Starburst SysOp Team	2026-08-18 17:19:13 (3 days ago)	BAD BOT, BAD BOT, WHAT YA GONNA DO - Detected and Blocked. Matched phrase "MJ12bot" at REQUEST_HEADE ... show more BAD BOT, BAD BOT, WHAT YA GONNA DO - Detected and Blocked. Matched phrase "MJ12bot" at REQUEST_HEADERS:User-Agent. (1100000-stl2-14) show less	Bad Web Bot
🇩🇪 MarkGGN	2026-08-18 08:00:22 (3 days ago)	Web attack. [1786762275] [0] [www.] [#4146353] [0] [2] [2a01:4f9:4a:2aa5::2] [403] [GET] [/author/m ... show more Web attack. [1786762275] [0] [www.] [#4146353] [0] [2] [2a01:4f9:4a:2aa5::2] [403] [GET] [/author/mark/page/139/] [User enumeration scan (author archives)] [hex:617574686f725f6e616d653d6d61726b] show less	Web App Attack
🇫🇷 claude CALVET	2026-08-18 06:53:29 (3 days ago)	gew-Joomla User : try to access forms...	Hacking

Showing 1 to 15 of 812 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 192.236.225.165

🇨🇱 191.112.214.178

🇫🇷 91.196.152.22

🇦🇷 216.244.224.178

🇧🇷 205.210.31.218

🇦🇷 190.120.188.154

🇺🇸 165.154.172.244

🇯🇵 153.235.98.181

🇦🇷 149.46.3.194

🇨🇳 111.121.210.129

🇫🇷 91.231.89.59

🇺🇸 47.251.45.25

🇳🇱 45.156.128.170

🇬🇧 35.203.211.41

🇺🇸 23.242.28.103

🇮🇳 2001:4490:4e95:c6e1:392f:4b2f:b964:529

🇨🇳 183.92.113.8

🇵🇱 176.53.159.198

🇺🇸 172.214.209.153

🇰🇪 102.213.48.46