JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a02:c207:2333:8816::1

2a02:c207:2333:8816::1 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 84%: ?

84%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmi3338816.contaboserver.net
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a02:c207:2333:8816::1

Whois 2a02:c207:2333:8816::1

IP Abuse Reports for 2a02:c207:2333:8816::1:

This IP address has been reported a total of 23 times from 15 distinct sources. 2a02:c207:2333:8816::1 was first reported on June 15th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-16 22:04:11 (2 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-15. show less	Web App Attack SSH Hacking
🇬🇧 openstrike.co.uk	2026-06-16 05:15:30 (2 days ago)	4 attacks on env grabbing URLs: GET /env/.env HTTP/1.1	Hacking
🇳🇱 Nrbrtkls	2026-06-15 19:19:21 (3 days ago)	Scanning for .env secrets files on Cloudflare-fronted site	Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 18:50:25 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserve ... show more (mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 14:50:08.413907 2026] [security2:error] [pid 14283:tid 14283] [client 2a02:c207:2333:8816::1:46344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "californiabrokers.net"] [uri "/.env"] [unique_id "ajBJYKRXuVyXwgzL6K_RRwAAACc"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-06-15 17:21:30 (3 days ago)	[MonJun1519:21:27.7375492026][security2:error][pid47902:tid48186][client2a02:c207:2333:8816::1:0]Mod ... show more [MonJun1519:21:27.7375492026][security2:error][pid47902:tid48186][client2a02:c207:2333:8816::1:0]ModSecurity:Accessdeniedwithcode403$phase1$.Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"hostingedomini.ch\"][uri\"/functions/.env\"][unique_id\"ajA0lzkcTyHsbLyCWVFd9wAAARE\"] show less	Hacking Web App Attack
🇩🇪 gadix	2026-06-15 17:18:54 (3 days ago)	[15/Jun/2026:19:18:53.189173 +0200] ajAz_eOh6n87Hk2FQyCdNgAAAAU 2a02:c207:2333:8816::1 47584 127.0.0 ... show more [15/Jun/2026:19:18:53.189173 +0200] ajAz_eOh6n87Hk2FQyCdNgAAAAU 2a02:c207:2333:8816::1 47584 127.0.0.1 7081 [15/Jun/2026:19:18:53.245380 +0200] ajAz_RxYG6Uqwie2YoS38AAAAAI 2a02:c207:2333:8816::1 47598 127.0.0.1 7081 [15/Jun/2026:19:18:53.261734 +0200] ajAz_ZBDobnAt7So8CaJgQAAAAA 2a02:c207:2333:8816::1 47604 127.0.0.1 7081 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 17:08:37 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserve ... show more (mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 13:08:34.307412 2026] [security2:error] [pid 14921:tid 14921] [client 2a02:c207:2333:8816::1:36238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "instepdogobedience.com"] [uri "/functions/.env"] [unique_id "ajAxkhkQ0LMfvMqTwCJqFwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 16:43:23 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserve ... show more (mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 12:43:19.479471 2026] [security2:error] [pid 15992:tid 15992] [client 2a02:c207:2333:8816::1:37020] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fundingworkingcapital.com"] [uri "/api/.env"] [unique_id "ajArpwGeBu1lVBjxeUnh3AAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 14:48:21 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserve ... show more (mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:48:18.509503 2026] [security2:error] [pid 11490:tid 11490] [client 2a02:c207:2333:8816::1:42606] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "advantagept.org"] [uri "/api/.env"] [unique_id "ajAQsmeJRVPu1IRPDfjkiAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 14:09:40 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserve ... show more (mod_security) mod_security (id:210492) triggered by 2a02:c207:2333:8816::1 (vmi3338816.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:09:34.626137 2026] [security2:error] [pid 8346:tid 8346] [client 2a02:c207:2333:8816::1:55546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pascalevial.com"] [uri "/.env"] [unique_id "ajAHnuted-XkbKAVVxKzywAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 stinpriza	2026-06-15 14:05:12 (3 days ago)	Web App Attack	Web App Attack
🇩🇪 4server	2026-06-15 13:54:59 (3 days ago)	[MonJun1515:54:55.1343732026][security2:error][pid72762:tid72819][client2a02:c207:2333:8816::1:0]Mod ... show more [MonJun1515:54:55.1343732026][security2:error][pid72762:tid72819][client2a02:c207:2333:8816::1:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"rs-gaming.net\"][uri\"/api/.env\"][unique_id\"ajAEL5VVSGfNHMGayDCvGwAAAAo\"] show less	Port Scan Brute-Force Web App Attack
🇧🇪 cmbplf	2026-06-15 13:42:26 (3 days ago)	2.619 requests with url.path *.env	Brute-Force Bad Web Bot
🇳🇱 e.fierstra	2026-06-15 13:33:28 (3 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇦🇺 Anytech	2026-06-15 13:31:09 (3 days ago)	Blocked by Conn-Monitor: Automated bot activity	Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 123.58.198.35

🇸🇪 81.226.129.67

🇳🇱 45.148.10.157

🇺🇸 216.25.89.117

🇫🇷 193.32.126.232

🇦🇪 145.241.123.102

🇵🇰 110.93.224.226

🇮🇩 103.146.202.84

🇬🇧 92.27.101.99

🇯🇵 37.19.205.241

🇺🇸 35.254.244.123

🇷🇴 2.57.122.238

🇬🇧 2a06:4880:8000::b5

🇭🇺 85.155.242.167

🇱🇹 81.30.98.142

🇨🇭 37.120.213.13

🇧🇷 143.95.209.223

🇫🇮 77.105.161.120

🇫🇷 43.96.110.129

🇺🇸 216.25.89.77