JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a03:b0c0:2:f0:0:2:4050:f001

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

100% Critical

40 reports

33 reporters · latest 6 hours ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇳🇱 Netherlands
City: Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

40 from 33 distinct reporters

First reported

November 7th 2026

Most recent report

6 hours ago

Last 60 days

Top reporter locations 🇳🇱 Netherlands 9 🇺🇸 United States of America 9 🇫🇷 France 7

Most common categories Web App Attack 29 Brute-Force 14 Bad Web Bot 13 Hacking 10 SQL Injection 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 VHosting	2026-11-10 04:35:05 UTC · (6 hours ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇫🇮 as211431.net	2026-11-10 01:31:14 UTC · (9 hours ago)	Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /%2eenv UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 This report ... show more Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /%2eenv UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 maxpower	2026-11-09 23:49:21 UTC · (10 hours ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 2a03:b0c0:2:f0:0:2:4050:f001 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2a03:b0c0:2:f0:0:2:4050:f001 - - [10/Nov/2026:00:49 ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 2a03:b0c0:2:f0:0:2:4050:f001 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 2a03:b0c0:2:f0:0:2:4050:f001 - - [10/Nov/2026:00:49:17 +0100] "GET /.aws/credentials HTTP/2.0" 404 201 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" "2a03:b0c0:2:f0:0:2:4050:f001" host=liverpoolitalia.it show less	Port Scan
🇫🇷 SpaceHost-Server	2026-11-09 23:17:31 UTC · (11 hours ago)		Brute-Force Web App Attack
🇳🇱 homeshowdomain.nl	2026-11-09 23:01:26 UTC · (11 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-08.	Web App Attack SSH Hacking
🇳🇱 Alt255	2026-11-09 17:42:55 UTC · (17 hours ago)	[ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2a03:b0c0:2:f0:0:2:4050:f001 - - [09/Nov/2026:18:42:46 +0100] "GET /.env HTTP/1.1" 404 25361 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537 ... show more [ti-30al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2a03:b0c0:2:f0:0:2:4050:f001 - - [09/Nov/2026:18:42:46 +0100] "GET /.env HTTP/1.1" 404 25361 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-09 17:17:27 UTC · (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 2a03:b0c0:2:f0:0:2:4050:f001 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 12:17:21.753114 2026] [security2:error] [pid 22971:tid 22971] [client 2 ... show more (mod_security) mod_security (id:210492) triggered by 2a03:b0c0:2:f0:0:2:4050:f001 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 12:17:21.753114 2026] [security2:error] [pid 22971:tid 22971] [client 2a03:b0c0:2:f0:0:2:4050:f001:53594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "acworthga.us"] [uri "/.git/config"] [unique_id "avIAIXlXclVB8EMVVRXzgwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 ZEROVOX	2026-11-09 16:44:33 UTC · (18 hours ago)	CrowdSec: crowdsecurity/http-sensitive-files detected	Web App Attack
🇫🇷 bazter.pro	2026-11-09 14:45:17 UTC · (20 hours ago)	Fail2Ban: plesk-bot-aggressive - 15 failures	Port Scan Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-09 09:16:50 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 2a03:b0c0:2:f0:0:2:4050:f001 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 04:16:42.987091 2026] [security2:error] [pid 28482:tid 28482] [client 2 ... show more (mod_security) mod_security (id:210492) triggered by 2a03:b0c0:2:f0:0:2:4050:f001 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 04:16:42.987091 2026] [security2:error] [pid 28482:tid 28482] [client 2a03:b0c0:2:f0:0:2:4050:f001:39656] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "frozentears.shop"] [uri "/.env"] [unique_id "avGPesPSjmRy17gbGtTCTgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 hchristo	2026-11-09 08:03:19 UTC · (1 day ago)	[Mon Nov 09 09:03:18.218071 2026] [authz_core:error] [pid 54274:tid 54368] [client 2a03:b0c0:2:f0:0:2:4050:f001:49802] AH01630: client denied by server configuration: /var/www/kd1121/htdocs/distril/wp-config.php.bak [Mon Nov 09 09:03:18.232554 2026] ... show more [Mon Nov 09 09:03:18.218071 2026] [authz_core:error] [pid 54274:tid 54368] [client 2a03:b0c0:2:f0:0:2:4050:f001:49802] AH01630: client denied by server configuration: /var/www/kd1121/htdocs/distril/wp-config.php.bak [Mon Nov 09 09:03:18.232554 2026] [authz_core:error] [pid 54274:tid 54372] [client 2a03:b0c0:2:f0:0:2:4050:f001:49802] AH01630: client denied by server configuration: /var/www/kd1121/htdocs/distril/wp-config.php.save [Mon Nov 09 09:03:18.247137 2026] [authz_core:error] [pid 54274:tid 54329] [client 2a03:b0c0:2:f0:0:2:4050:f001:49802] AH01630: client denied by server configuration: /var/www/kd1121/htdocs/distril/wp-config.php~ [Mon Nov 09 09:03:18.261716 2026] [authz_core:error] [pid 54274:tid 54349] [client 2a03:b0c0:2:f0:0:2:4050:f001:49802] AH01630: client denied by server configuration: /var/www/kd1121/htdocs/distril/wp-config.php.swp [Mon Nov 09 09:03:18.276648 2026] [authz_core:error] [pid 54274:tid 54354] [client 2a03:b0c0:2:f0:0:2:4050:f001:49802] AH01630: client den ... show less	Brute-Force
🇳🇱 CryptoYakari	2026-11-09 06:36:15 UTC · (1 day ago)	2026-11-09 09:36:11,072 fail2ban.actions [2052]: NOTICE [nginx-404] Ban 2a03:b0c0:2:f0:0:2:4050:f001 2026-11-09 09:36:12,964 fail2ban.actions [2052]: NOTICE [apache-noscript] Ban 2a03:b0c0:2:f0:0:2:4050:f001 ...	Hacking
Anonymous	2026-11-09 06:09:35 UTC · (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 2a03:b0c0:2:f0:0:2:4050:f001 (Unknown)	SQL Injection
🇺🇸 interbiznw.com	2026-11-09 05:53:44 UTC · (1 day ago)	malicious-web-requests-vulnerability-scanning	Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 helios.live	2026-11-09 05:44:34 UTC · (1 day ago)	2026/11/09 05:44:32 [error] 579754#579754: 312916 access forbidden by rule, client: 2a03:b0c0:2:f0:0:2:4050:f001, server: kocervpn.com, request: "GET /.laratrace-probe-78f1cb872a60 HTTP/1.1", host: "kocervpn.com" 2026/11/09 05:44:33 [error] 579754#5 ... show more 2026/11/09 05:44:32 [error] 579754#579754: 312916 access forbidden by rule, client: 2a03:b0c0:2:f0:0:2:4050:f001, server: kocervpn.com, request: "GET /.laratrace-probe-78f1cb872a60 HTTP/1.1", host: "kocervpn.com" 2026/11/09 05:44:33 [error] 579754#579754: 312916 access forbidden by rule, client: 2a03:b0c0:2:f0:0:2:4050:f001, server: kocervpn.com, request: "GET /.env HTTP/1.1", host: "kocervpn.com" 2026/11/09 05:44:33 [error] 579754#579754: 312916 access forbidden by rule, client: 2a03:b0c0:2:f0:0:2:4050:f001, server: kocervpn.com, request: "GET /.env.bak HTTP/1.1", host: "kocervpn.com" 2026/11/09 05:44:33 [error] 579754#579754: 312916 access forbidden by rule, client: 2a03:b0c0:2:f0:0:2:4050:f001, server: kocervpn.com, request: "GET /.env.old HTTP/1.1", host: "kocervpn.com" 2026/11/09 05:44:33 [error] 579754#579754: 312947 access forbidden by rule, client: 2a03:b0c0:2:f0:0:2:4050:f001, server: kocervpn.com, request: "GET /.env.local HTTP/1.1", host: "kocervpn.com" ... show less	Web App Attack

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇱 188.212.135.174

🇸🇬 114.119.148.242

🇳🇱 109.160.32.118

🇫🇷 103.110.163.249

🇳🇱 45.148.10.141

🇷🇴 2.57.122.150

🇵🇱 2400:cb00:923:1000:54da:ffd6:2e99:460c

🇺🇸 205.210.31.60

🇫🇷 178.18.241.205

🇳🇱 109.160.32.119

🇻🇳 103.63.108.25

🇺🇸 70.183.226.45

🇳🇱 64.205.72.93

🇰🇷 14.50.43.74

🇰🇭 202.62.47.156

🇺🇸 198.98.53.213

🇧🇷 131.100.242.102

🇧🇩 103.133.201.145

🇧🇪 23.251.134.61

🇺🇸 20.245.185.222