JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a04:3544:8000:1000:64eb:98ff:fed4:554d

2a04:3544:8000:1000:64eb:98ff:fed4:554d was found in our database!

This IP was reported 16 times. Confidence of Abuse is 0%: ?

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	UpCloud Cloud Servers
Usage Type	Data Center/Web Hosting/Transit
ASN	AS202053
Domain Name	upcloud.com
Country	🇵🇱 Poland
City	Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a04:3544:8000:1000:64eb:98ff:fed4:554d

Whois 2a04:3544:8000:1000:64eb:98ff:fed4:554d

IP Abuse Reports for 2a04:3544:8000:1000:64eb:98ff:fed4:554d:

This IP address has been reported a total of 16 times from 11 distinct sources. 2a04:3544:8000:1000:64eb:98ff:fed4:554d was first reported on March 27th 2026, and the most recent report was 5 months ago.

Old Reports: The most recent abuse report for this IP address is from 5 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 jjnxpct	2026-03-28 04:48:41 (5 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /index.php (Rule ID: 941100) - XSS Attack Detected via libinjection show less	Web App Attack SQL Injection
Anonymous	2026-03-28 00:36:54 (5 months ago)	"GET /.env HTTP/1.1"	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-03-27 22:33:20 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-9 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 18:33:11.302548 2026] [security2:error] [pid 12613:tid 12613] [client 2a04:3544:8000:1000:64eb:98ff:fed4:554d:33722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "old.renju.net"] [uri "/.env"] [unique_id "accFp8wLLce-8oeaN4YAYQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-27 22:08:06 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-9 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 18:07:59.611307 2026] [security2:error] [pid 418:tid 418] [client 2a04:3544:8000:1000:64eb:98ff:fed4:554d:46050] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "transportadoresaereos.com"] [uri "/.env"] [unique_id "acb_v4IkXdam6S7BHCPZBAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-27 20:55:59 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-9 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 16:55:54.088548 2026] [security2:error] [pid 8122:tid 8122] [client 2a04:3544:8000:1000:64eb:98ff:fed4:554d:44876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hanabritgermanshepherds.com"] [uri "/.env"] [unique_id "acbu2sKvtyGiEQPTWLKwtAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 debaba	2026-03-27 20:45:31 (5 months ago)	[27/Mar/2026:20:45:30.690085 +0000] acbsarigq4ntZuxfZVAGiwAAAE8 2a04:3544:8000:1000:64eb:98ff:fed4:5 ... show more [27/Mar/2026:20:45:30.690085 +0000] acbsarigq4ntZuxfZVAGiwAAAE8 2a04:3544:8000:1000:64eb:98ff:fed4:554d 54878 127.0.0.1 7081 [27/Mar/2026:20:45:30.768 ... show less	Brute-Force Web App Attack
🇺🇸 Starburst SysOp Team	2026-03-27 20:17:47 (5 months ago)	(mod_security-custom) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d ... show more (mod_security-custom) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): 1 in the last 3600 secs (0-srv1) show less	Hacking
🇩🇪 rupruprup	2026-03-27 19:59:12 (5 months ago)	Firewall Block: Web Scraper / Bad Bot	Web App Attack
Anonymous	2026-03-27 19:42:46 (5 months ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇧🇪 cmbplf	2026-03-27 19:39:31 (5 months ago)	305 requests with url.path *.env	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-27 19:30:10 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-9 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 15:29:59.303059 2026] [security2:error] [pid 9366:tid 9366] [client 2a04:3544:8000:1000:64eb:98ff:fed4:554d:46728] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cs-mall.com"] [uri "/.env"] [unique_id "acbat6hnxruiUJ95LzkvdwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-03-27 19:29:26 (5 months ago)	(db_admin_scan) srv102 DB admin scan 2a04:3544:8000:1000:64eb:98ff:fed4:554d (PL/Poland/-): 1 in the ... show more (db_admin_scan) srv102 DB admin scan 2a04:3544:8000:1000:64eb:98ff:fed4:554d (PL/Poland/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-03-27 19:09:40 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-9 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 15:09:35.750244 2026] [security2:error] [pid 25009:tid 25009] [client 2a04:3544:8000:1000:64eb:98ff:fed4:554d:60512] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.powerkiteforum.com"] [uri "/.env"] [unique_id "acbV71GSSDCmNtr_aszAMwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-03-27 18:55:24 (5 months ago)	(mod_security) mod_security triggered on hostname [redacted] 2a04:3544:8000:1000:64eb:98ff:fed4:554d ... show more (mod_security) mod_security triggered on hostname [redacted] 2a04:3544:8000:1000:64eb:98ff:fed4:554d (64eb-98ff-fed4-554d.v6.pl-waw1.upcloud.host): (CF_ENABLE) show less	SQL Injection
Anonymous	2026-03-27 18:50:10 (5 months ago)	\| SQL injection attempt.	Web App Attack Hacking SQL Injection

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.188.168

🇲🇾 202.165.22.102

🇳🇱 172.71.102.251

🇵🇭 136.158.64.248

🇲🇦 102.54.246.130

🇺🇸 100.29.192.123

🇷🇴 92.118.39.205

🇩🇪 69.5.169.170

🇸🇪 68.67.118.169

🇺🇸 45.61.170.217

🇺🇸 159.223.205.243

🇺🇸 154.217.245.175

🇨🇳 112.252.148.242

🇷🇺 95.37.232.197

🇺🇸 66.132.195.125

🇮🇳 66.116.232.29

🇱🇹 62.60.130.253

🇺🇸 45.79.145.254

🇺🇸 45.43.57.5

🇮🇷 37.32.6.138