JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a04:c300:c00::3bc

Neutral Activity IPv6 SLAAC Note

Abuse Confidence Score

0% Low Risk

23 reports

16 reporters · latest 3 months ago

ISP: Advin Services LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS206216
Domain Name: advinservers.com
Country: 🇩🇪 Germany
City: Nuremberg, Bavaria

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

2a04:c300:c00::3bc has been reported 23 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

23 from 16 distinct reporters

First reported

July 8th 2026

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 gumbysoft	2026-07-29 08:40:06 UTC · (3 months ago)	Unauthorized web vulnerability scan (/.env, wordpress, etc.)	Web App Attack
🇺🇸 TPI-Abuse	2026-07-28 17:50:35 UTC · (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 13:50:30.014312 2026] [security2:error] [pid 1495978:tid 1495978] [client 2a04:c3 ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 13:50:30.014312 2026] [security2:error] [pid 1495978:tid 1495978] [client 2a04:c300:c00::3bc:57910] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|wfowisdom.systemcapacityoptimization.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wfowisdom.systemcapacityoptimization.com"] [uri "/php5.ini"] [unique_id "amjr5l9ai2Qi9REU4wyPmQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-23 04:31:53 UTC · (3 months ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇺🇸 TPI-Abuse	2026-07-23 02:36:33 UTC · (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 22:36:28.084076 2026] [security2:error] [pid 2364288:tid 2364288] [client 2a04:c3 ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 22:36:28.084076 2026] [security2:error] [pid 2364288:tid 2364288] [client 2a04:c300:c00::3bc:19480] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|xirination.com\|F\|2"] [data ".js.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "xirination.com"] [uri "/dist/main.js.bak"] [unique_id "amF-LC9ROq3t0CTJhmW01QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 as211431.net	2026-07-22 19:22:55 UTC · (3 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 This r ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-07-22 05:50:34 UTC · (3 months ago)	Web application attack detected and weak spots site scanning.	Web App Attack
🇩🇪 HandyTreff.de	2026-07-22 05:28:42 UTC · (3 months ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -43.607 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.	Web App Attack Bad Web Bot
🇩🇪 AetherFox	2026-07-21 15:19:00 UTC · (3 months ago)	AetherFox VoidGuard detected: [Tue Jul 21 15:18:58.224149 2026] [authz_core:error] [pid 2023138:tid 2023168] [client 2a04:c300:c00::3bc:52312] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.php/reg.html, referer: http:// ... show more AetherFox VoidGuard detected: [Tue Jul 21 15:18:58.224149 2026] [authz_core:error] [pid 2023138:tid 2023168] [client 2a04:c300:c00::3bc:52312] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.php/reg.html, referer: http://event.draconigen.net/ [Tue Jul 21 15:18:59.261917 2026] [authz_core:error] [pid 2023138:tid 2023165] [client 2a04:c300:c00::3bc:52328] AH01630: client denied by server configuration: proxy:https://[MASKED]/pws.php [Tue Jul 21 15:18:59.280307 2026] [authz_core:error] [pid 2023138:tid 2023142] [client 2a04:c300:c00::3bc:52378] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.php/reg.htmlmedia/system/js/messages.min.js, referer: https://event.draconigen.net/media/system/js/messages.min.js?9a4811 [Tue Jul 21 15:18:59.284050 2026] [authz_core:error] [pid 2023138:tid 2023159] [client 2a04:c300:c00::3bc:52456] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.ph ... show less	Bad Web Bot Web App Attack
Anonymous	2026-07-19 15:07:03 UTC · (3 months ago)	Automated web scanner. Requested suspicious paths: /config.js. UTC: 2026-07-19 14:45:36.	Web App Attack
🇩🇪 marcel-knorr.de	2026-07-18 04:43:33 UTC · (3 months ago)	[MK-Root1] Blocked by UFW	Brute-Force Port Scan
🇺🇸 TPI-Abuse	2026-07-16 10:41:05 UTC · (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 06:40:58.154251 2026] [security2:error] [pid 15771:tid 15771] [client 2a04:c300:c ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 06:40:58.154251 2026] [security2:error] [pid 15771:tid 15771] [client 2a04:c300:c00::3bc:3476] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.koswerks.net\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.koswerks.net"] [uri "/index.bak"] [unique_id "ali1OlzlqVa1SpsqP7eP6wAAAE0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 03:58:29 UTC · (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 23:58:23.780787 2026] [security2:error] [pid 28578:tid 28578] [client 2a04:c300:c ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 23:58:23.780787 2026] [security2:error] [pid 28578:tid 28578] [client 2a04:c300:c00::3bc:42858] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|keystroke.info\|F\|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystroke.info"] [uri "/LocalSettings.php.backup"] [unique_id "alhW36Et6-6dI2lBmvS-sQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 03:10:08 UTC · (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 23:10:01.576509 2026] [security2:error] [pid 31389:tid 31389] [client 2a04:c300:c ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 23:10:01.576509 2026] [security2:error] [pid 31389:tid 31389] [client 2a04:c300:c00::3bc:54514] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|discountphotogifts.com\|F\|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "discountphotogifts.com"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "alhLidZcZKx3BQhtm_DCDAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 14:30:47 UTC · (3 months ago)	(mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 10:30:38.972281 2026] [security2:error] [pid 26238:tid 26245] [client 2a04:c300:c ... show more (mod_security) mod_security (id:210730) triggered by 2a04:c300:c00::3bc (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 10:30:38.972281 2026] [security2:error] [pid 26238:tid 26245] [client 2a04:c300:c00::3bc:12688] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.alfred.merart.com\|F\|2"] [data ".js.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.alfred.merart.com"] [uri "/dist/main.js.bak"] [unique_id "aleZjr3m2OmHadDhYPBw_wAAAIU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Webhoster	2026-07-13 05:22:47 UTC · (3 months ago)	{"ClientAddr":"104.23.239.88:13297","ClientHost":"2a04:c300:c00::3bc","ClientPort":"13297","ClientUsername":"-","DownstreamContentSize":0,"DownstreamStatus":403,"Duration":30739267,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead": ... show more {"ClientAddr":"104.23.239.88:13297","ClientHost":"2a04:c300:c00::3bc","ClientPort":"13297","ClientUsername":"-","DownstreamContentSize":0,"DownstreamStatus":403,"Duration":30739267,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":30739267,"RequestAddr":"obsidian.timvdberg.dev","RequestContentSize":0,"RequestCount":360884,"RequestHost":"obsidian.timvdberg.dev","RequestMethod":"GET","RequestPath":"/","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"obsidian@file","StartLocal":"2026-07-13T05:22:47.110212876Z","StartUTC":"2026-07-13T05:22:47.110212876Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"https","level":"info","msg":"","request_Cf-Connecting-Ip":"2a04:c300:c00::3bc","request_X-Forwarded-For":"2a04:c300:c00::3bc","request_X-Real-Ip":"104.23.239.88","time":"2026-07-13T05:22:47Z"} {"ClientAddr":"172.68.193.194:9301","ClientHost":"2a04:c300:c00::3bc","ClientPort":"9301","ClientUserna ... show less	Port Scan Hacking Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇪 102.209.76.137

🇱🇹 62.60.134.212

🇺🇸 2605:a141:2364:2925::1

🇰🇷 220.76.91.28

🇯🇵 216.226.78.10

🇹🇷 201.4.65.113

🇦🇷 181.116.56.142

🇬🇧 147.45.179.82

🇫🇷 143.244.57.121

🇨🇳 113.141.171.139

🇨🇦 85.217.149.70

🇰🇿 81.91.185.178

🇷🇸 77.105.37.219

🇫🇷 46.105.132.35

🇩🇰 46.30.212.205

🇪🇬 41.41.34.178

🇺🇸 2604:a880:400:d1:0:5:5f35:e001

🇸🇳 213.154.77.61

🇸🇪 171.25.158.87

🇭🇰 154.92.2.59