JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a02:c207:2295:3236::1

2a02:c207:2295:3236::1 was found in our database!

This IP was reported 42 times. Confidence of Abuse is 62%: ?

62%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmi2953236.contaboserver.net
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a02:c207:2295:3236::1

Whois 2a02:c207:2295:3236::1

IP Abuse Reports for 2a02:c207:2295:3236::1:

This IP address has been reported a total of 42 times from 19 distinct sources. 2a02:c207:2295:3236::1 was first reported on August 6th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-08-15 03:31:34 (2 weeks ago)	WordPress login brute-force \| req: /wp-login.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App ... show more WordPress login brute-force \| req: /wp-login.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 show less	Brute-Force Web App Attack
🇫🇷 pm33	2026-08-14 17:47:26 (2 weeks ago)	Wordpress login attempts	Brute-Force
🇩🇪 pltcldvlpr	2026-08-13 12:06:58 (2 weeks ago)	CMS/framework probe: 2a02:c207:2295:3236::1 - - [13/Aug/2026:14:06:57 +0200] "GET /wp-json/ HTTP/2.0 ... show more CMS/framework probe: 2a02:c207:2295:3236::1 - - [13/Aug/2026:14:06:57 +0200] "GET /wp-json/ HTTP/2.0" 404 94423 "-" "wp2shell" asn=51167 org="Contabo GmbH" country=DE ... show less	Web App Attack
Anonymous	2026-08-09 04:33:18 (3 weeks ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇳🇱 homeshowdomain.nl	2026-08-07 21:59:49 (3 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-06. show less	Web App Attack SSH Hacking
🇺🇸 interbiznw.com	2026-08-07 14:12:14 (3 weeks ago)	malicious-web-requests-vulnerability-scanning	Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-08-07 14:00:36 (3 weeks ago)	(mod_security) mod_security (id:949110) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserve ... show more (mod_security) mod_security (id:949110) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 10:00:29.263878 2026] [security2:error] [pid 2095179:tid 2095179] [client 2a02:c207:2295:3236::1:35074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "danchujkoassoc.com"] [uri "/.env"] [unique_id "anXk_UhvHE7eK5OjXjg9CgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-07 11:51:45 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserve ... show more (mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 07:51:38.833147 2026] [security2:error] [pid 18730:tid 18730] [client 2a02:c207:2295:3236::1:37748] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|dadhania.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dadhania.net"] [uri "/"] [unique_id "anXGyj9T1CsUBZUlUate4AAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 hidemail.app	2026-08-07 10:01:09 (3 weeks ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-08-07 08:55:46 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserve ... show more (mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 04:55:40.715525 2026] [security2:error] [pid 1665963:tid 1665963] [client 2a02:c207:2295:3236::1:39350] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|galvez.cc\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "galvez.cc"] [uri "/"] [unique_id "anWdjOxPfpHu20Ptzg0GqgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-07 06:45:27 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserve ... show more (mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 02:45:20.230805 2026] [security2:error] [pid 2588536:tid 2588536] [client 2a02:c207:2295:3236::1:49878] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|chickiesbeef.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "chickiesbeef.com"] [uri "/"] [unique_id "anV_AHde2GB_CjVQX29IJQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-08-07 05:35:27 (3 weeks ago)	Try to access /.env	Web App Attack
🇩🇪 gadix	2026-08-07 04:54:01 (3 weeks ago)	[07/Aug/2026:06:54:00.354491 +0200] anVk6FtactdM9A49jTNqKQAAAAA 2a02:c207:2295:3236::1 45784 127.0.0 ... show more [07/Aug/2026:06:54:00.354491 +0200] anVk6FtactdM9A49jTNqKQAAAAA 2a02:c207:2295:3236::1 45784 127.0.0.1 7081 [07/Aug/2026:06:54:01.000340 +0200] anVk6G7xwXf3bMUc1BOYmgAAAAU 2a02:c207:2295:3236::1 45792 127.0.0.1 7081 [07/Aug/2026:06:54:01.059896 +0200] anVk6T_QO364qUoNtC8hxgAAAAM 2a02:c207:2295:3236::1 45800 127.0.0.1 7081 ... show less	Web App Attack
🇵🇱 Niko's Stuff	2026-08-07 04:44:34 (3 weeks ago)	Triggered crowdsecurity/http-sensitive-files. More information at: https://app.crowdsec.net/cti/2a02 ... show more Triggered crowdsecurity/http-sensitive-files. More information at: https://app.crowdsec.net/cti/2a02:c207:2295:3236::1 show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-08-07 04:38:27 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserve ... show more (mod_security) mod_security (id:210350) triggered by 2a02:c207:2295:3236::1 (vmi2953236.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 07 00:38:21.048482 2026] [security2:error] [pid 21775:tid 21775] [client 2a02:c207:2295:3236::1:44032] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|bikelatch.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bikelatch.com"] [uri "/"] [unique_id "anVhPaXkHK5ByhhAIA2atAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.30

🇵🇭 124.106.88.166

🇩🇪 104.207.62.146

🇨🇳 218.29.196.162

🇦🇷 181.46.185.118

🇺🇸 173.255.225.15

🇺🇸 162.216.150.35

🇩🇪 157.230.119.211

🇺🇸 147.185.132.237

🇺🇸 147.185.132.27

🇺🇸 143.198.52.18

🇧🇩 123.253.3.16

🇻🇳 118.68.26.140

🇫🇷 91.196.152.184

🇺🇸 66.249.83.3

🇺🇸 64.62.197.176

🇺🇸 20.168.124.121

🇺🇸 4.154.215.12

🇷🇴 2.57.121.112

🇩🇪 213.182.213.57