JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a02:c207:2326:6654::1

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

100% Critical

109 reports

65 reporters · latest 20 hours ago

ISP: Contabo GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS51167
Hostname(s): vmi3266654.contaboserver.net
Domain Name: contabo.com
Country: 🇫🇷 France
City: Lauterbourg, Grand Est

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

109 from 65 distinct reporters

First reported

November 7th 2026

Most recent report

20 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 30 🇺🇸 United States of America 22 🇳🇱 Netherlands 17

Most common categories Web App Attack 94 Bad Web Bot 41 Brute-Force 34 Hacking 27 Port Scan 7

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-11-12 14:46:45 UTC · (20 hours ago)	Automated report: 4 malicious HTTP request(s) blocked by WAF/IPS on public web services. Requested: /wp-json/gravitysmtp/v1/tests/mock-data	Bad Web Bot Web App Attack
🇮🇹 ciccio diddo	2026-11-12 14:10:17 UTC · (20 hours ago)	High Burst multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇳🇱 e.fierstra	2026-11-12 13:31:06 UTC · (21 hours ago)	excessive HTTP 404 errors	Bad Web Bot
🇺🇸 Charlesiv	2026-11-12 09:34:28 UTC · (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK ASN: 51167 (Contabo GmbH) Protocol: HTTP/1.1 (GET method) Endpoint: /.env.save Timestamp: 2026-11-12T06:21:05Z Ray ID: a5936f3deb27dc7a UA: Mozilla/5.0 (Windows NT 10.0; Win64; x6 ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK ASN: 51167 (Contabo GmbH) Protocol: HTTP/1.1 (GET method) Endpoint: /.env.save Timestamp: 2026-11-12T06:21:05Z Ray ID: a5936f3deb27dc7a UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 Major Hostility	2026-11-12 09:02:09 UTC · (1 day ago)	"GET /api/session/properties HTTP/1.1" 404 "GET /api/session/properties HTTP/1.1" 404	Web App Attack
🇵🇱 Budyn	2026-11-12 06:13:34 UTC · (1 day ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: vpn.dont-eat-the-pudding.online \| Path: /pathscan-67e25a931786-nope.env \| User-Agent: Mozilla ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: vpn.dont-eat-the-pudding.online \| Path: /pathscan-67e25a931786-nope.env \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
Anonymous	2026-11-12 04:37:22 UTC · (1 day ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇺🇸 Charlesiv	2026-11-12 03:03:08 UTC · (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK ASN: 51167 (Contabo GmbH) Protocol: HTTP/1.1 (GET method) Endpoint: /.env.backup Timestamp: 2026-11-12T02:47:02Z Ray ID: a59235ae28e5d3b8 UA: Mozilla/5.0 (Windows NT 10.0; Win64; ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK ASN: 51167 (Contabo GmbH) Protocol: HTTP/1.1 (GET method) Endpoint: /.env.backup Timestamp: 2026-11-12T02:47:02Z Ray ID: a59235ae28e5d3b8 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 marcel-knorr.de	2026-11-12 00:52:36 UTC · (1 day ago)	[MK-Root1] Blocked by UFW	Brute-Force Port Scan
🇵🇱 Budyn	2026-11-11 22:49:05 UTC · (1 day ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: forum.teddypot.pro \| Path: /pathscan-fecd7a350f69-nope.env \| User-Agent: Mozilla/5.0 (Windows ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: forum.teddypot.pro \| Path: /pathscan-fecd7a350f69-nope.env \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 Optimatiq (ThreatBite)	2026-11-11 22:42:01 UTC · (1 day ago)	Probe for secrets or exploit paths (fail2ban)	Hacking Web App Attack
🇩🇪 kkw	2026-11-11 20:37:05 UTC · (1 day ago)	[REDACTED] 2a02:c207:2326:6654::1 - - [11/Nov/2026:21:37:04 +0100] "GET /.git/config HTTP/1.1" 302 562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... (mode: searching http-sen ... show more [REDACTED] 2a02:c207:2326:6654::1 - - [11/Nov/2026:21:37:04 +0100] "GET /.git/config HTTP/1.1" 302 562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... (mode: searching http-sensitive-files) show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-11-11 20:31:23 UTC · (1 day ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: cdn.sweetpuddingtrap.online \| Path: /pathscan-3f09ce9a1e0a-nope.env \| User-Agent: Mozilla/5.0 ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: cdn.sweetpuddingtrap.online \| Path: /pathscan-3f09ce9a1e0a-nope.env \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 wpadm3	2026-11-11 18:48:09 UTC · (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇵🇱 Budyn	2026-11-11 18:25:05 UTC · (1 day ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: app.teddypot.space \| Path: /pathscan-ce91790dd20a-nope.env \| User-Agent: Mozilla/5.0 (Windows ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: app.teddypot.space \| Path: /pathscan-ce91790dd20a-nope.env \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| Request: [Empty / GET Request] show less	Hacking Web App Attack

Showing 1 to 15 of 109 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇷 205.210.31.157

🇲🇾 202.186.78.167

🇧🇷 181.191.202.226

🇨🇳 180.76.247.197

🇺🇸 162.216.150.28

🇪🇸 159.253.248.50

🇫🇷 146.70.40.70

🇨🇳 139.212.68.43

🇺🇸 137.184.52.40

🇺🇸 136.0.39.68

🇮🇳 125.23.220.130

🇺🇸 70.164.32.220

🇺🇸 54.152.163.42

🇬🇧 5.252.83.71

🇮🇳 223.235.244.164

🇺🇸 206.189.217.192

🇨🇱 201.223.238.115

🇺🇦 193.93.218.99

🇦🇷 186.128.56.86

🇿🇦 165.16.170.120