JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a04:c300:400::1bb

2a04:c300:400::1bb was found in our database!

This IP was reported 45 times. Confidence of Abuse is 91%: ?

91%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Advin Services LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS22295
Domain Name	advinservers.com
Country	🇺🇸 United States of America
City	Kansas City, Missouri

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a04:c300:400::1bb

Whois 2a04:c300:400::1bb

IP Abuse Reports for 2a04:c300:400::1bb:

This IP address has been reported a total of 45 times from 15 distinct sources. 2a04:c300:400::1bb was first reported on June 21st 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-24 02:49:57 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 22:49:53.253760 2026] [security2:error] [pid 31418:tid 31418] [client 2a04:c300:400::1bb:8544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.catholicshopper.com"] [uri "/.env.local.orig"] [unique_id "ajtF0aPbRZDKEPckdbSkUgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 konseptit	2026-06-24 01:00:13 (13 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 2a04:c300:400::1bb (US/United States/-)	SQL Injection
🇺🇸 TPI-Abuse	2026-06-23 19:35:56 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 15:35:52.860209 2026] [security2:error] [pid 11036:tid 11036] [client 2a04:c300:400::1bb:29680] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.intelligent-design.net.jpastorphotographics.com"] [uri "/.env.staging"] [unique_id "ajrgGJq4cxxRHLH3VxYabAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 15:09:46 (23 hours ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 11:09:41.066129 2026] [security2:error] [pid 23997:tid 23997] [client 2a04:c300:400::1bb:15310] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.aticom.net\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.aticom.net"] [uri "/wp-content/debug.log"] [unique_id "ajqhtX_RhgQdDB5d8h6cbAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-06-23 12:23:10 (1 day ago)	(modsecurity) srv102 ModSecurity 2a04:c300:400::1bb (DE/Germany/-): 10 in the last 3600 secs; Ports: ... show more (modsecurity) srv102 ModSecurity 2a04:c300:400::1bb (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇬🇧 Aetherweb Ark	2026-06-23 03:07:28 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::1bb (Unknown): N in the last X s ... show more (mod_security) mod_security (id:949110) triggered by 2a04:c300:400::1bb (Unknown): N in the last X secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 02:09:56 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:949110) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 22:09:51.948846 2026] [security2:error] [pid 23116:tid 23116] [client 2a04:c300:400::1bb:10430] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.exorex.com"] [uri "/wp-content/debug.log"] [unique_id "ajnq70_djsAc09m4ww_65gAAACw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 01:20:26 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 21:20:23.472699 2026] [security2:error] [pid 1040:tid 1040] [client 2a04:c300:400::1bb:3628] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|calificacionyvalidacionsicav.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "calificacionyvalidacionsicav.com"] [uri "/wp-content/debug.log"] [unique_id "ajnfV0s82UYrl6N-VMGOfwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 23:46:44 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 19:46:37.152059 2026] [security2:error] [pid 7359:tid 7359] [client 2a04:c300:400::1bb:11832] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.daydar.net"] [uri "/laravel/.env"] [unique_id "ajnJXerA3Lt7Ds6u3X7faAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-22 22:09:26 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 homeshowdomain.nl	2026-06-22 22:03:13 (1 day ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-21. show less	Web App Attack SSH Hacking
🇳🇱 Mangelot Hosting	2026-06-22 20:56:13 (1 day ago)	(modsecurity) srv201 ModSecurity 2a04:c300:400::1bb (DE/Germany/-): 10 in the last 3600 secs; Ports: ... show more (modsecurity) srv201 ModSecurity 2a04:c300:400::1bb (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 20:47:44 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 ... show more (mod_security) mod_security (id:210492) triggered by 2a04:c300:400::1bb (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 16:47:40.273404 2026] [security2:error] [pid 23572:tid 23572] [client 2a04:c300:400::1bb:30288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.arthuryeung.net"] [uri "/.env.test"] [unique_id "ajmfbH5TPkaoWEFXXTmxtgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 antlac1	2026-06-22 20:40:57 (1 day ago)	crowdsecurity/http-crawl-non_statics	Brute-Force Web App Attack
🇳🇱 Mangelot Hosting	2026-06-22 20:28:01 (1 day ago)	(modsecurity) srv104 ModSecurity 2a04:c300:400::1bb (DE/Germany/-): 10 in the last 3600 secs; Ports: ... show more (modsecurity) srv104 ModSecurity 2a04:c300:400::1bb (DE/Germany/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇬 41.38.50.27

🇰🇷 183.105.107.28

🇺🇸 152.32.235.160

🇺🇸 66.132.186.232

🇸🇬 4.194.23.79

🇺🇸 172.215.239.208

🇺🇸 135.119.73.164

🇻🇳 116.111.186.22

🇷🇺 95.47.246.223

🇧🇬 79.124.40.138

🇨🇳 218.25.89.208

🇬🇧 193.163.125.13

🇺🇸 64.62.156.145

🇳🇱 45.148.10.141

🇫🇷 185.177.72.52

🇧🇷 45.4.179.4

🇺🇸 166.70.21.183

🇭🇰 154.221.28.214

🇮🇳 128.185.253.98

🇨🇳 119.29.93.87