JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a03:4000:0:322:c4a2:5ff:fe67:a0a4

2a03:4000:0:322:c4a2:5ff:fe67:a0a4 was found in our database!

This IP was reported 62 times. Confidence of Abuse is 20%: ?

20%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	netcup GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197540
Hostname(s)	a2fa9.netcup.net
Domain Name	netcup.de
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a03:4000:0:322:c4a2:5ff:fe67:a0a4

Whois 2a03:4000:0:322:c4a2:5ff:fe67:a0a4

IP Abuse Reports for 2a03:4000:0:322:c4a2:5ff:fe67:a0a4:

This IP address has been reported a total of 62 times from 21 distinct sources. 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 was first reported on September 25th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-22 03:32:09 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcu ... show more (mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcup.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 23:32:04.772174 2026] [security2:error] [pid 3692:tid 3692] [client 2a03:4000:0:322:c4a2:5ff:fe67:a0a4:48348] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.appalachianfolkmagician.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.appalachianfolkmagician.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajistBCMIHYTBEG18M-MjAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob.fr	2026-06-22 02:15:05 (1 week ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-14 11:29:40 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcu ... show more (mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcup.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 07:29:33.346401 2026] [security2:error] [pid 8591:tid 8591] [client 2a03:4000:0:322:c4a2:5ff:fe67:a0a4:60264] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|theyoungstrategist.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "theyoungstrategist.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ai6QnatLytEihWcyRlO5pwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-14 07:48:30 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcu ... show more (mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcup.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 03:48:22.705648 2026] [security2:error] [pid 19092:tid 19092] [client 2a03:4000:0:322:c4a2:5ff:fe67:a0a4:40996] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tarekshohaieb.online\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tarekshohaieb.online"] [uri "/wp-json/wp/v2/users"] [unique_id "ai5cxvyujqQyf7509HClGAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 22:42:36 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcu ... show more (mod_security) mod_security (id:225170) triggered by 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 (a2fa9.netcup.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 18:42:29.050004 2026] [security2:error] [pid 9753:tid 9753] [client 2a03:4000:0:322:c4a2:5ff:fe67:a0a4:56822] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.soundtrax.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.soundtrax.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ai3c1cMVCZN5y9o9nBNr6QAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-13 16:54:40 (2 weeks ago)	Attac	Brute-Force
🇩🇪 F242	2026-05-02 06:21:50 (1 month ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇩🇪 LRob.fr	2026-05-02 06:00:12 (1 month ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 NicoID	2026-05-02 01:32:10 (1 month ago)	2a03:4000:0:322:c4a2:5ff:fe67:a0a4 - - [01/May/2026:19:32:09 -0600] "POST /xmlrpc.php HTTP/1.1" 200 ... show more 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 - - [01/May/2026:19:32:09 -0600] "POST /xmlrpc.php HTTP/1.1" 200 485 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0" ... show less	Brute-Force
🇩🇪 LRob.fr	2025-03-21 00:16:02 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇫🇷 ecodehost.com	2025-03-19 17:21:02 (1 year ago)	Domain : cozumdoktoru.com Rule : wp-login 2025-03-19 17:19:59 10.100.1.20 POST /wp-login.php - 443 - ... show more Domain : cozumdoktoru.com Rule : wp-login 2025-03-19 17:19:59 10.100.1.20 POST /wp-login.php - 443 - 172.70.248.56 HTTP/2 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 - cozumdoktoru.com 404 0 2 1374 689 3368 - 2a03:4000:0:322:c4a2:5ff:fe67:a0a4 show less	Web App Attack
🇩🇪 LRob.fr	2025-03-19 00:14:04 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇺🇸 dtorrer	2025-03-18 07:27:46 (1 year ago)	Brute-force general attack.	Brute-Force
🇩🇪 LRob.fr	2025-03-17 00:12:36 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇩🇪 LRob.fr	2025-03-16 00:11:46 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking

Showing 1 to 15 of 62 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 74.115.172.118

🇺🇸 44.105.220.58

🇹🇳 197.5.145.8

🇧🇴 190.181.27.37

🇧🇷 179.184.0.32

🇦🇪 176.205.35.152

🇺🇸 162.216.149.51

🇺🇸 104.9.60.148

🇺🇸 91.230.168.234

🇵🇱 88.220.189.56

🇳🇱 77.83.39.233

🇩🇪 51.75.64.35

🇺🇸 44.87.235.69

🇨🇳 8.136.189.162

🇳🇱 2a00:1450:4013:c03::125

🇬🇧 195.140.214.30

🇺🇸 148.153.121.146

🇵🇰 110.38.234.222

🇷🇴 109.98.253.101

🇨🇳 106.75.177.125