JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a02:c206:3015:2326::1

Recent Activity IPv6 SLAAC Note

Abuse confidence score ?

70% Elevated

349 reports

56 reporters · latest 6 hours ago

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	crawler-cs-02.webxtrend.com
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2a02:c206:3015:2326::1

Export CSV

This IP address has been reported a total of 349 times from 56 distinct sources. 2a02:c206:3015:2326::1 was first reported on October 28th 2024, and the most recent report was 6 hours ago. In the last 60 days, the top reporter locations were: United States of America with 12 reports; Germany with 7 reports; Poland with 5 reports. The most common categories in these recent reports were: Bad Web Bot 25 times; Web App Attack 13 times; Hacking 8 times; Port Scan 6 times; Brute-Force 3 times; Other 3 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-20 04:07:35 (6 hours ago)	(mod_security) mod_security (id:210730) triggered by 2a02:c206:3015:2326::1 (crawler-cs-02.webxtrend ... show more (mod_security) mod_security (id:210730) triggered by 2a02:c206:3015:2326::1 (crawler-cs-02.webxtrend.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 00:07:29.182027 2026] [security2:error] [pid 14789:tid 14789] [client 2a02:c206:3015:2326::1:41922] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.fractalsky.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.fractalsky.com"] [uri "/blackhorrormovie.com"] [unique_id "atbpAVYeZRBmtACbNI5Q-QAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 LotPhantom	2026-10-19 06:11:53 (1 day ago)	2a02:c206:3015:2326::1 - - [19/Oct/2026:06:11:37 +0000] "GET /robots.txt HTTP/1.1" 301 162 "-" "Mozi ... show more 2a02:c206:3015:2326::1 - - [19/Oct/2026:06:11:37 +0000] "GET /robots.txt HTTP/1.1" 301 162 "-" "Mozilla/5.0 (compatible; webXtrendBot/1.1; +https://webxtrend.com/crawler)" "0" ... show less	Web App Attack Bad Web Bot
🇩🇪 HERA - Operations	2026-10-16 17:32:13 (3 days ago)	herrmann - searching for vulnerable scripts: robots.txt 2026/10/16 19:32:13	Web App Attack
🇺🇸 slay3r9903	2026-10-16 00:47:20 (4 days ago)	IP address blocked by Cloudflare security rules due to suspicious activity and security violations.	Hacking Bad Web Bot
🇺🇸 xserverx.ru	2026-10-10 20:24:31 (1 week ago)	Honeypot triggered: IP: 2a02:c206:3015:2326::1 Request to: https://horny-pot.ru/robots.txt Method: G ... show more Honeypot triggered: IP: 2a02:c206:3015:2326::1 Request to: https://horny-pot.ru/robots.txt Method: GET Host: horny-pot.ru User-Agent: Mozilla/5.0 (compatible; webXtrendBot/1.1; +https://webxtrend.com/crawler) Referer: Direct Country: FR ASN: Unknown Triggered rules: (127\.0\.0\.1\|localhost\|0\.0\.0\.0\|::1\|169\.254\.169\.254), (spider\|crawl\|scrape) Timestamp: 2026-10-10T20:24:31.692Z show less	Hacking Bad Web Bot Web App Attack
🇫🇷 cityhunter_rhone	2026-10-10 19:05:03 (1 week ago)	Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-10-10 20:59:47 \| hits_4 ... show more Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-10-10 20:59:47 \| hits_403=2 \| hits_404=0 \| ip=2a02:c206:3015:2326::1 \| sample_uri=/ show less	Port Scan Hacking Web App Attack
🇨🇦 lakered	2026-10-09 22:44:13 (1 week ago)	Detectors: [NGINX] \| Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ... show more Detectors: [NGINX] \| Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban \| Evidence: Persistent-Slow-Scanner (Strikes: 4), TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 3) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 \| TCP Fingerprint: Unknown (Link:PPPoE, Uptime:40497m) show less	Port Scan Web App Attack
🇺🇸 Charlesiv	2026-10-09 02:12:46 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK ASN: 51167 (Contabo GmbH) Pro ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK ASN: 51167 (Contabo GmbH) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-10-09T01:49:36Z Ray ID: a479bad18abf4da2 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 show less	Bad Web Bot
🇭🇺 kranem	2026-10-08 15:00:01 (1 week ago)	Triggered Cloudflare WAF from FR. Action taken: LINK_MAZE_INJECTED ASN: 51167 (Contabo GmbH) Protoco ... show more Triggered Cloudflare WAF from FR. Action taken: LINK_MAZE_INJECTED ASN: 51167 (Contabo GmbH) Protocol: HTTP/2 (GET method) Endpoint: / Timestamp: 2026-10-08T14:54:03Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 show less	Bad Web Bot
🇺🇸 sandra361	2026-10-06 02:55:04 (2 weeks ago)	Cloudflare WAF: 1 request from AS51167/FR \| Action: link_maze_injected \| GET HTTP/2 \| Path: / \| User ... show more Cloudflare WAF: 1 request from AS51167/FR \| Action: link_maze_injected \| GET HTTP/2 \| Path: / \| User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 show less	Bad Web Bot
🇫🇷 cityhunter_rhone	2026-10-05 08:20:16 (2 weeks ago)	Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-10-03 23:37:52 \| hits_4 ... show more Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-10-03 23:37:52 \| hits_403=1 \| hits_404=0 \| ip=2a02:c206:3015:2326::1 \| sample_uri=/ show less	Port Scan Hacking Web App Attack
🇸🇬 leithzz	2026-10-05 01:37:17 (2 weeks ago)	1x HTTP 403 to krynox.dev from FR, method GET, path /. Blocked by Cloudflare action block (firewallC ... show more 1x HTTP 403 to krynox.dev from FR, method GET, path /. Blocked by Cloudflare action block (firewallCustom). Repeated L7 flood traffic. show less	DDoS Attack Web App Attack
🇺🇸 slay3r9903	2026-10-04 01:51:49 (2 weeks ago)	IP address blocked by Cloudflare security rules due to suspicious activity and security violations.	Hacking Bad Web Bot
🇭🇺 kranem	2026-10-02 21:00:08 (2 weeks ago)	Triggered Cloudflare WAF from FR. Action taken: LINK_MAZE_INJECTED ASN: 51167 (Contabo GmbH) Protoco ... show more Triggered Cloudflare WAF from FR. Action taken: LINK_MAZE_INJECTED ASN: 51167 (Contabo GmbH) Protocol: HTTP/2 (GET method) Endpoint: / Timestamp: 2026-10-02T19:54:54Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 show less	Bad Web Bot
🇨🇦 lakered	2026-10-02 14:26:52 (2 weeks ago)	Detectors: [NGINX] \| Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ... show more Detectors: [NGINX] \| Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban \| Evidence: TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 2) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 \| TCP Fingerprint: Unknown (Link:PPPoE, Uptime:29920m) show less	Port Scan Web App Attack

Showing 1 to 15 of 349 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 189.204.230.91

🇨🇳 116.55.245.26

🇦🇺 110.149.208.68

🇰🇬 213.109.66.157

🇲🇾 202.165.15.132

🇳🇱 195.178.110.227

🇳🇱 185.226.197.38

🇨🇦 176.113.74.138

🇵🇪 149.34.49.23

🇵🇭 112.207.121.193

🇨🇳 112.3.100.100

🇪🇸 86.127.230.252

🇧🇷 45.229.107.141

🇺🇸 43.130.62.16

🇨🇳 42.194.182.170

🇷🇺 37.112.177.67

🇫🇮 34.88.80.151

🇳🇱 185.226.197.37

🇸🇬 168.144.141.199

🇳🇱 165.22.207.17