JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a01:ecc0:480:16d::2

2a01:ecc0:480:16d::2 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 40%: ?

40%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	SERV.HOST GROUP LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS207957
Domain Name	serv.host
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a01:ecc0:480:16d::2

Whois 2a01:ecc0:480:16d::2

IP Abuse Reports for 2a01:ecc0:480:16d::2:

This IP address has been reported a total of 15 times from 7 distinct sources. 2a01:ecc0:480:16d::2 was first reported on September 19th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 conseilgouz	2026-10-21 21:25:04 (1 day ago)	avw-(visforms) : try to access forms...	Hacking
🇺🇸 TPI-Abuse	2026-10-20 23:32:17 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 2a01:ecc0:480:16d::2 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 2a01:ecc0:480:16d::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 19:32:10.506950 2026] [security2:error] [pid 9980:tid 9980] [client 2a01:ecc0:480:16d::2:33598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "georgegourmet.com"] [uri "/wp-config.php"] [unique_id "atf5-gZ9RqInLOa9cPhHiAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-20 19:07:23 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.website \| URI: /wp-admin/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇬🇧 neo101	2026-10-18 23:01:53 (4 days ago)	Secret Hunting & Credential Harvesting: Automated scanner (Nuclei (Secret Hunter)) probed decoy secr ... show more Secret Hunting & Credential Harvesting: Automated scanner (Nuclei (Secret Hunter)) probed decoy secrets path '/.env'. Served AI System Override decoy payload as counter-measure. show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-14 20:44:21 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dont-eat-the-pudding.xyz \| URI: /wp-admin/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 slay3r9903	2026-10-09 06:12:40 (2 weeks ago)	IP address blocked by Cloudflare security rules due to suspicious activity and security violations.	Hacking Bad Web Bot
🇵🇱 Budyn	2026-10-01 01:10:23 (3 weeks ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.site \| URI: /wp-admin/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-28 20:58:35 (3 weeks ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dont-eat-the-pudding.xyz \| URI: /wp-admin/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-26 07:33:33 (3 weeks ago)	(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:16d::2 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:16d::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 03:33:27.827311 2026] [security2:error] [pid 2199:tid 2199] [client 2a01:ecc0:480:16d::2:42054] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|spaceritual.net\|F\|2"] [data ".old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "spaceritual.net"] [uri "/index.old"] [unique_id "ard1R9o4nJ9Xg0TansGS-AAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-23 19:13:49 (4 weeks ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.tech \| URI: /wp-admin/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-09-22 22:54:49 (1 month ago)	slw-(visforms) : try to access forms...	Hacking
Anonymous	2026-09-22 20:38:22 (1 month ago)	2a01:ecc0:480:16d::2 - - [22/Sep/2026:22:38:21 +0200] "GET / HTTP/1.1" 403 5824 "-" "Mozilla/5.0 (Wi ... show more 2a01:ecc0:480:16d::2 - - [22/Sep/2026:22:38:21 +0200] "GET / HTTP/1.1" 403 5824 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" ... show less	Web App Attack
🇩🇪 LRob	2026-09-21 07:10:08 (1 month ago)	Walking a list of paths that do not exist (scanning) \| method: GET \| path: /modalites-examens/ (+2 m ... show more Walking a list of paths that do not exist (scanning) \| method: GET \| path: /modalites-examens/ (+2 more) \| 2026-09-21 07:10 UTC show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-09-21 04:51:17 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:16d::2 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:16d::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:51:10.779092 2026] [security2:error] [pid 7483:tid 7483] [client 2a01:ecc0:480:16d::2:32842] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cameronsol.com\|F\|2"] [data ".camerongunsmith.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cameronsol.com"] [uri "/www.camerongunsmith.com"] [unique_id "arC3vnUzDtFsiHYvckTY5wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-19 11:12:56 (1 month ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: / \| 2026-09-19 11:12 UTC show less	Bad Web Bot

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 217.113.194.248

🇺🇸 154.28.229.1

🇺🇸 147.90.234.22

🇨🇦 85.217.149.61

🇻🇪 38.166.191.226

🇬🇧 35.203.211.37

🇬🇧 35.203.210.174

🇧🇪 34.78.249.233

🇫🇮 194.99.27.148

🇷🇴 193.32.162.5

🇺🇦 185.255.237.170

🇲🇽 177.242.11.59

🇨🇳 175.9.244.54

🇺🇸 173.46.91.38

🇺🇸 171.22.217.234

🇺🇸 171.22.217.118

🇧🇩 103.242.22.117

🇺🇸 70.167.235.112

🇺🇸 66.132.172.223

🇧🇷 45.174.0.176