JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a02:c204:2195:2012::1

2a02:c204:2195:2012::1 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 5%: ?

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	sortie-tor.a-n-o-n-y-m-e.net
Domain Name	contabo.com
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	Portsmouth, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a02:c204:2195:2012::1

Whois 2a02:c204:2195:2012::1

IP Abuse Reports for 2a02:c204:2195:2012::1:

This IP address has been reported a total of 37 times from 8 distinct sources. 2a02:c204:2195:2012::1 was first reported on November 8th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-08-29 02:06:12 (2 days ago)	Blocked by UFW (TCP on 35974) Source port: 443 Packet length: 96 This report (for 2a02:c204:2195:20 ... show more Blocked by UFW (TCP on 35974) Source port: 443 Packet length: 96 This report (for 2a02:c204:2195:2012:0000:0000:0000:0001) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-07-29 07:40:27 (1 month ago)	Blocked by UFW (TCP on 37594) Source port: 443 Packet length: 96 This report (for 2a02:c204:2195:20 ... show more Blocked by UFW (TCP on 37594) Source port: 443 Packet length: 96 This report (for 2a02:c204:2195:2012:0000:0000:0000:0001) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇮🇹 VHosting	2026-06-25 15:14:23 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 xmission.com	2026-05-31 11:53:32 (3 months ago)	Blocked by UFW (TCP on 8333) Source port: 5315 Packet length: 80 This report (for 2a02:c204:2195:20 ... show more Blocked by UFW (TCP on 8333) Source port: 5315 Packet length: 80 This report (for 2a02:c204:2195:2012:0000:0000:0000:0001) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-05 11:00:17 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 07:00:11.832010 2026] [security2:error] [pid 15322:tid 15322] [client 2a02:c204:2195:2012::1:1955] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|billymitchell.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "billymitchell.com"] [uri "/mitchell_com.sql"] [unique_id "afnNuzz87TjifBowkPy-GwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-26 21:03:27 (4 months ago)	2026-04-26 08:00:43,928 fail2ban.actions [7718]: NOTICE [tor] Ban 2a02:c204:2195:2012::1 202 ... show more 2026-04-26 08:00:43,928 fail2ban.actions [7718]: NOTICE [tor] Ban 2a02:c204:2195:2012::1 2026-04-26 12:01:35,727 fail2ban.actions [7718]: NOTICE [tor] Ban 2a02:c204:2195:2012::1 2026-04-26 18:01:33,411 fail2ban.actions [7718]: NOTICE [tor] Ban 2a02:c204:2195:2012::1 2026-04-26 21:01:30,873 fail2ban.actions [7718]: NOTICE [tor] Ban 2a02:c204:2195:2012::1 2026-04-27 00:03:25,831 fail2ban.actions [7718]: NOTICE [tor] Ban 2a02:c204:2195:2012::1 show less	Brute-Force
🇮🇹 VHosting	2026-03-26 20:34:00 (5 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-23 13:35:27 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 08:35:22.416831 2026] [security2:error] [pid 12453:tid 12453] [client 2a02:c204:2195:2012::1:25619] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|artspacecleveland.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "artspacecleveland.com"] [uri "/ecleveland_db.sql"] [unique_id "aZxXmr43Xc3bmkjy7IfeOwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-07 17:20:56 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 07 12:20:48.633804 2026] [security2:error] [pid 7664:tid 7664] [client 2a02:c204:2195:2012::1:24247] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|goldcountrygermanamericanclub.org\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "goldcountrygermanamericanclub.org"] [uri "/b_prod.sql"] [unique_id "aYd0cIEjULWxtrZ6JBgsEwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-03 11:29:52 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 03 06:29:46.057995 2026] [security2:error] [pid 28128:tid 28128] [client 2a02:c204:2195:2012::1:36005] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|nwuoregon.org\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nwuoregon.org"] [uri "/weekly.sql"] [unique_id "aYHcKnr5JboQcaB7w66Z6gAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-16 19:30:42 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 14:30:36.698230 2026] [security2:error] [pid 3773456:tid 3773476] [client 2a02:c204:2195:2012::1:38929] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|iacsb.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "iacsb.com"] [uri "/backupwp.sql"] [unique_id "aWqR3AhE8Dw2auQP0aAC2QAAARE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-14 11:22:52 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210492) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 06:22:45.559739 2026] [security2:error] [pid 12370:tid 12370] [client 2a02:c204:2195:2012::1:52819] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.naturalhomebuilders.com"] [uri "/.git/config"] [unique_id "aWd8hepaXddp6qGpb669xAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-11 22:18:25 (8 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 11 17:18:21.249201 2025] [security2:error] [pid 7283:tid 7283] [client 2a02:c204:2195:2012::1:18267] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|hawarcenter.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hawarcenter.com"] [uri "/hawarcent.sql"] [unique_id "aTtDLRvC_CcRrSEg9di8BgAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-09 15:40:40 (8 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 09 10:40:31.946607 2025] [security2:error] [pid 25667:tid 25667] [client 2a02:c204:2195:2012::1:36047] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|elgatocapa.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elgatocapa.com"] [uri "/backupdb.sql"] [unique_id "aThC77cCdTzzHDbcIBlRxQAAADk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-06 20:09:36 (8 months ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m- ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c204:2195:2012::1 (sortie-tor.a-n-o-n-y-m-e.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 15:09:30.764199 2025] [security2:error] [pid 31496:tid 31504] [client 2a02:c204:2195:2012::1:17933] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|arizonasolutionsgroup.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "arizonasolutionsgroup.com"] [uri "/backup_wp.sql"] [unique_id "aTSNet9RPvtReZsKa_c-hwAAAEY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 167.172.129.109

🇮🇩 112.78.134.58

🇮🇳 103.216.145.2

🇳🇱 185.242.226.19

🇩🇪 185.117.250.245

🇰🇷 183.111.125.26

🇹🇷 176.90.172.94

🇫🇷 149.202.50.58

🇫🇷 85.217.140.16

🇬🇧 80.1.51.168

🇫🇷 77.239.124.130

🇺🇸 66.148.126.142

🇺🇸 47.188.142.98

🇺🇸 45.33.109.18

🇨🇳 36.133.16.107

🇨🇳 218.59.235.170

🇧🇷 189.126.73.11

🇺🇦 185.151.86.51

🇮🇸 185.40.122.250

🇬🇧 165.22.117.76