JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a03:b0c0:1:d0::c8c:6001

2a03:b0c0:1:d0::c8c:6001 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 82%: ?

82%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a03:b0c0:1:d0::c8c:6001

Whois 2a03:b0c0:1:d0::c8c:6001

IP Abuse Reports for 2a03:b0c0:1:d0::c8c:6001:

This IP address has been reported a total of 28 times from 16 distinct sources. 2a03:b0c0:1:d0::c8c:6001 was first reported on September 29th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-10-14 15:19:16 (2 days ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-10-14 UTC.	Brute-Force Exploited Host
Anonymous	2026-10-14 06:05:05 (2 days ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇵🇱 Budyn	2026-10-14 05:31:56 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: pma.definitelynotahoneypot.online \| URI: /.env.txt \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-10-13 17:50:18 (3 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-10-13 17:42:37 (3 days ago)	2a03:b0c0:1:d0::c8c:6001 - - [13/Oct/2026:19:42:34 +0200] "GET /.env.save HTTP/1.1" 301 545 "-" "Moz ... show more 2a03:b0c0:1:d0::c8c:6001 - - [13/Oct/2026:19:42:34 +0200] "GET /.env.save HTTP/1.1" 301 545 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a03:b0c0:1:d0::c8c:6001 - - [13/Oct/2026:19:42:34 +0200] "GET /.env.dev HTTP/1.1" 301 543 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a03:b0c0:1:d0::c8c:6001 - - [13/Oct/2026:19:42:34 +0200] "GET /.env.production HTTP/1.1" 301 557 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a03:b0c0:1:d0::c8c:6001 - - [13/Oct/2026:19:42:34 +0200] "GET /.env.swp HTTP/1.1" 301 543 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 2a03:b0c0:1:d0::c8c:6001 - - [13/Oct/2026:19:42:34 +0200] "GET /.env.bak HTTP/1.1" 301 543 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 show less	Web App Attack Hacking
🇵🇱 Budyn	2026-10-13 15:35:19 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: metrics.teddypot.pro \| URI: /.git/config \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 seal	2026-10-13 09:57:52 (3 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	SSH Brute-Force
🇪🇸 arturotrenard	2026-10-13 09:28:49 (3 days ago)	WordPress attack blocked (wp-defender): exploit-probe: https://frmotor.eu/wp-json/gravitysmtp/v1/tes ... show more WordPress attack blocked (wp-defender): exploit-probe: https://frmotor.eu/wp-json/gravitysmtp/v1/tests/mock-data?page=gravity show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 07:24:59 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 2a03:b0c0:1:d0::c8c:6001 (Unknown): 1 in the la ... show more (mod_security) mod_security (id:210492) triggered by 2a03:b0c0:1:d0::c8c:6001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 03:24:52.225795 2026] [security2:error] [pid 24275:tid 24275] [client 2a03:b0c0:1:d0::c8c:6001:59394] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "advisorstudios.cms2020.com"] [uri "/.git/config"] [unique_id "as3cxCUXPLmNLbRGXEV-DwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 HerrWolf	2026-10-13 06:45:03 (3 days ago)	CrowdSec Detection: crowdsecurity/http-sensitive-files	Web App Attack
🇵🇱 Budyn	2026-10-13 03:34:29 (4 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: beta.astropot.site \| URI: /.env.txt \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 00:32:46 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 2a03:b0c0:1:d0::c8c:6001 (Unknown): 1 in the la ... show more (mod_security) mod_security (id:210492) triggered by 2a03:b0c0:1:d0::c8c:6001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 20:32:40.252753 2026] [security2:error] [pid 13318:tid 13318] [client 2a03:b0c0:1:d0::c8c:6001:55246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.radicalchange.org"] [uri "/.env.txt"] [unique_id "as18KP6Da5THFULv34eaAAAAACk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-12 22:24:26 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 2a03:b0c0:1:d0::c8c:6001 (Unknown): 1 in the la ... show more (mod_security) mod_security (id:210492) triggered by 2a03:b0c0:1:d0::c8c:6001 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 18:24:21.339005 2026] [security2:error] [pid 17597:tid 17600] [client 2a03:b0c0:1:d0::c8c:6001:56206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nopictures.productions.pwrcoupling.com"] [uri "/.git/config"] [unique_id "as1eFb3IXmG2fsm7o2dWtQAAAUE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-10-12 22:00:51 (4 days ago)	Try to access /.git/config	Web App Attack
🇩🇪 neckaralb-admin.de	2026-10-12 10:40:28 (4 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇧 185.97.95.213

🇨🇳 120.198.23.233

🇪🇸 46.253.45.10

🇸🇪 46.59.88.232

🇰🇷 221.162.218.85

🇺🇸 195.184.76.187

🇨🇳 183.232.212.197

🇻🇳 117.4.254.98

🇺🇸 100.33.249.226

🇷🇺 87.251.81.76

🇳🇱 77.91.71.11

🇺🇸 64.62.156.162

🇱🇹 62.60.134.212

🇺🇸 40.124.123.217

🇺🇸 172.232.3.17

🇸🇬 165.22.51.61

🇨🇦 85.217.149.61

🇨🇦 85.217.149.13

🇺🇸 72.17.34.38

🇳🇱 45.148.10.157