JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227

2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 24%: ?

24%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Free SAS
Usage Type	Fixed Line ISP
ASN	AS12322
Domain Name	free.fr
Country	🇫🇷 France
City	Paris, Ile-de-France

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227

Whois 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227

IP Abuse Reports for 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:

This IP address has been reported a total of 10 times from 5 distinct sources. 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 was first reported on August 24th 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Jakub Sikora	2026-08-27 06:01:01 (3 weeks ago)	PHP webshell scanner detected by honeytrap. Threat score: 142, total requests: 46. Probed paths: /ro ... show more PHP webshell scanner detected by honeytrap. Threat score: 142, total requests: 46. Probed paths: /robots.txt, /.env.staging, /sites/default/settings.php, /phpinfo.php, /site/config.php. Triggered honeypots: robots, canary_env, tarpit, wp_login. show less	Hacking Bad Web Bot Web App Attack
🇦🇺 Klaverstyn	2026-08-27 01:58:25 (3 weeks ago)	Repeated 403 Forbidden responses	Web App Attack
🇳🇱 homeshowdomain.nl	2026-08-26 21:59:07 (3 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-25. show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-08-26 06:02:05 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown) ... show more (mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 02:02:01.104647 2026] [security2:error] [pid 29837:tid 29837] [client 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:44290] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bakerimaging.com"] [uri "/.git/config"] [unique_id "ao6BWUoTzdBgRnZf8k7mYwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 05:21:22 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown) ... show more (mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 01:21:14.153459 2026] [security2:error] [pid 30744:tid 30744] [client 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:47808] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abakada.net"] [uri "/.env"] [unique_id "ao53yoVbl2Yg6DBDsGq-sAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 12:56:25 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown) ... show more (mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 08:56:20.561508 2026] [security2:error] [pid 13461:tid 13461] [client 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:46172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.frenosilent.ar"] [uri "/.env"] [unique_id "ao2Q9MDvw5PcRd4qy4rvNQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 00:52:06 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown) ... show more (mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 20:52:01.245171 2026] [security2:error] [pid 16192:tid 16192] [client 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:49208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abq4you.com"] [uri "/.env"] [unique_id "aoznMcMtuttytL6_U9AhlAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 00:01:07 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown) ... show more (mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 20:00:57.600622 2026] [security2:error] [pid 6290:tid 6394] [client 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:57990] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.megawattscorp.com"] [uri "/.git/config"] [unique_id "aozbOaKRHS_JJM_TS3fomwAAANg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-08-24 23:45:05 (3 weeks ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 22:30:05 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown) ... show more (mod_security) mod_security (id:210492) triggered by 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 18:29:58.735221 2026] [security2:error] [pid 9905:tid 9905] [client 2a01:e0a:e9c:18a0:9e2d:cdff:feb1:9227:40706] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "corangues.com"] [uri "/.git/config"] [unique_id "aozF5mITLkoMP0rIk6jPnwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 91.204.86.20

🇧🇪 34.38.113.81

🇮🇹 31.190.186.213

🇵🇦 201.77.55.225

🇺🇸 193.3.53.5

🇺🇦 192.162.134.21

🇧🇷 181.218.172.74

🇺🇸 162.216.150.189

🇮🇹 158.47.223.16

🇫🇮 157.180.79.73

🇮🇳 150.129.31.76

🇩🇪 130.12.182.197

🇵🇭 112.205.210.197

🇨🇳 106.36.154.181

🇺🇸 71.90.30.53

🇮🇳 59.93.105.215

🇰🇷 59.8.114.245

🇸🇬 34.21.171.167

🇺🇸 20.253.248.98

🇧🇪 207.175.17.111