JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a02:4780:13:1052:0:3522:9596:1

2a02:4780:13:1052:0:3522:9596:1

Neutral Activity IPv6 SLAAC Note

32 reports found in our database

0% Low Risk

Abuse confidence score ?

ISP

HOSTINGER BR

Usage Type

Content Delivery Network

ASN

AS47583

Domain Name

hostinger.com

Country

🇧🇷 Brazil

City

Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

2a02:4780:13:1052:0:3522:9596:1 has been reported 32 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 2a02:4780:13:1052:0:3522:9596:1:

This IP address has been reported a total of 32 times from 16 distinct sources. 2a02:4780:13:1052:0:3522:9596:1 was first reported on June 6th 2026, and the most recent report was 2 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-09 22:00:55 (2 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-08. show less	Web App Attack SSH Hacking
🇵🇱 ketovoila.pl	2026-06-08 12:22:44 (2 months ago)	ketovoila.pl web app secret/repository scan: hits=12; unique_paths=12; sample_paths=/.env,/.env.save ... show more ketovoila.pl web app secret/repository scan: hits=12; unique_paths=12; sample_paths=/.env,/.env.save,/admin/.env; UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"; window=2026-06-08T12:22:44Z..2026-06-08T12:22:44Z show less	Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-08 10:43:06 (2 months ago)	[MonJun0812:43:00.8003312026][security2:error][pid1094635:tid1094813][client2a02:4780:13:1052:0:3522 ... show more [MonJun0812:43:00.8003312026][security2:error][pid1094635:tid1094813][client2a02:4780:13:1052:0:3522:9596:1:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"gustotondo.ch\"][uri\"/dev/.env\"][unique_id\"aiactOW8mkFX_G3_vO5QSwAAARM\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 10:11:25 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 06:11:18.504158 2026] [security2:error] [pid 12540:tid 12540] [client 2a02:4780:13:1052:0:3522:9596:1:21218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "beebesties.com"] [uri "/admin/.env"] [unique_id "aiaVRgLrWIom6FEfMnYHEgAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 AbuseBaer	2026-06-08 09:23:22 (3 months ago)	access attempt detected by IDS script (A)	Web App Attack
🇳🇱 e.fierstra	2026-06-08 09:21:16 (3 months ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 filstal.org	2026-06-08 09:21:02 (3 months ago)	CrowdSec: crowdsecurity/http-probing	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-06-08 07:17:28 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 03:17:21.633019 2026] [security2:error] [pid 20618:tid 20618] [client 2a02:4780:13:1052:0:3522:9596:1:51478] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bizzmail.net"] [uri "/.env"] [unique_id "aiZsgT5O-lO8MD7tZDWBGAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-08 05:14:25 (3 months ago)	Multiple WAF Violations	Web App Attack
🇬🇧 openstrike.co.uk	2026-06-08 05:13:49 (3 months ago)	24 attacks on env grabbing URLs: GET /backend/.env HTTP/1.1	Hacking
🇺🇸 TPI-Abuse	2026-06-08 00:52:00 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 20:51:53.461817 2026] [security2:error] [pid 30957:tid 30957] [client 2a02:4780:13:1052:0:3522:9596:1:20346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "encoremtmorris.com"] [uri "/admin/.env"] [unique_id "aiYSKYKWy5hoSaMfQfbewQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-07 16:56:00 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 12:55:54.137390 2026] [security2:error] [pid 20509:tid 20509] [client 2a02:4780:13:1052:0:3522:9596:1:32420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aykuatelier.com"] [uri "/laravel/.env"] [unique_id "aiWimoztaQEA8BDO9nITUQAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-07 16:04:19 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in ... show more (mod_security) mod_security (id:210492) triggered by 2a02:4780:13:1052:0:3522:9596:1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 12:04:16.164445 2026] [security2:error] [pid 3681:tid 3681] [client 2a02:4780:13:1052:0:3522:9596:1:61372] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ran101.com"] [uri "/laravel/.env"] [unique_id "aiWWgHccMvUr2LkoEEC0EwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-07 15:51:03 (3 months ago)	http scanning for .env files ...	Hacking Web App Attack
🇳🇱 Mangelot Hosting	2026-06-07 14:46:53 (3 months ago)	(modsecurity) srv104 ModSecurity 2a02:4780:13:1052:0:3522:9596:1 (BR/Brazil/-): 10 in the last 3600 ... show more (modsecurity) srv104 ModSecurity 2a02:4780:13:1052:0:3522:9596:1 (BR/Brazil/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:4:efb7:7001

🇺🇸 159.89.228.211

🇺🇸 195.184.76.232

🇺🇸 134.209.223.94

🇮🇳 117.247.17.88

🇧🇬 109.160.32.93

🇧🇬 109.160.32.84

🇺🇸 107.211.37.253

🇮🇳 106.214.3.220

🇭🇰 103.61.39.154

🇫🇷 91.231.89.203

🇺🇸 64.23.130.4

🇺🇸 20.118.236.29

🇮🇹 195.231.112.219

🇽🇰 185.188.217.211

🇷🇸 185.37.26.204

🇩🇪 150.241.77.28

🇰🇷 112.184.50.152

🇺🇸 52.248.42.105

🇳🇱 45.148.10.141