JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a06:a880:5:2d94::1

2a06:a880:5:2d94::1 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 100%: ?

100%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	STYLISH BY A&L SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS9009
Domain Name	07internet.ro
Country	🇳🇱 Netherlands
City	The Hague, South Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a06:a880:5:2d94::1

Whois 2a06:a880:5:2d94::1

IP Abuse Reports for 2a06:a880:5:2d94::1:

This IP address has been reported a total of 35 times from 25 distinct sources. 2a06:a880:5:2d94::1 was first reported on June 19th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-22 22:03:26 (1 week ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-21. show less	Web App Attack SSH Hacking
🇳🇱 Site.eu	2026-06-22 11:13:02 (1 week ago)	Excessive multi-domain requests	Brute-Force
🇹🇼 ip4.tw	2026-06-21 20:13:01 (1 week ago)	Malicious web scan	Hacking Web App Attack
🇺🇸 ipblock.com	2026-06-21 20:09:00 (1 week ago)	IPBlock protected site ID [1438-do]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇩🇰 ScamAware	2026-06-21 20:08:57 (1 week ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 26. Unique request paths counted internally: 17. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Web App Attack
🇺🇸 Major Hostility	2026-06-21 19:27:50 (1 week ago)	"GET /wp-content/debug.log HTTP/1.1" 404 "GET /.env HTTP/1.1" 404 "GET /secrets.yml HTTP/1.1" 404 "G ... show more "GET /wp-content/debug.log HTTP/1.1" 404 "GET /.env HTTP/1.1" 404 "GET /secrets.yml HTTP/1.1" 404 "GET /application.yml HTTP/1.1" 404 "GET /api/.env HTTP/1.1" 404 "GET /.env.example HTTP/1.1" 404 "GET /secrets.json HTTP/1.1" 404 "GET /.aws/credentials HTTP/1.1" 404 show less	Web App Attack
🇬🇧 Aetherweb Ark	2026-06-21 18:20:51 (1 week ago)	(mod_security) mod_security (id:949110) triggered by 2a06:a880:5:2d94::1 (Unknown): N in the last X ... show more (mod_security) mod_security (id:949110) triggered by 2a06:a880:5:2d94::1 (Unknown): N in the last X secs show less	Web App Attack
🇩🇪 Admins@FBN	2026-06-21 15:06:20 (1 week ago)	FW-PortScan: Traffic Blocked srcport=48098 dstport=80	Port Scan
🇺🇸 TPI-Abuse	2026-06-21 07:29:57 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 03:29:50.338101 2026] [security2:error] [pid 3809:tid 3809] [client 2a06:a880:5:2d94::1:42826] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adrienberthaud.com"] [uri "/.env.example"] [unique_id "ajeS7rExBaQYKeLOLvv8FQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 07:14:52 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 03:14:45.355852 2026] [security2:error] [pid 9634:tid 9634] [client 2a06:a880:5:2d94::1:36604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bodybuildbid.com"] [uri "/.env"] [unique_id "ajePZTNpMXEnepqu1DIL1AAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-06-21 06:19:22 (1 week ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇫🇷 bazter.pro	2026-06-21 01:32:58 (1 week ago)	Auto-Ban [2026-06-21 01:32:58]: CRITICAL: bot trap (soft) \| host=www.geoproceso.com \| route=/.env \| ... show more Auto-Ban [2026-06-21 01:32:58]: CRITICAL: bot trap (soft) \| host=www.geoproceso.com \| route=/.env \| hits=1 \| ua=Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 01:13:54 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 21:13:48.640213 2026] [security2:error] [pid 4414:tid 4414] [client 2a06:a880:5:2d94::1:60736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.boblog111.com"] [uri "/.env.example"] [unique_id "ajc6zDmj8-SRnrWCt2Ej-gAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-06-20 23:00:06 (1 week ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-20 19:35:47 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2a06:a880:5:2d94::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 15:35:40.334926 2026] [security2:error] [pid 17254:tid 17254] [client 2a06:a880:5:2d94::1:33330] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stmaarten-boatcharters.com"] [uri "/.env.example"] [unique_id "ajbrjFuwq0ccFdQCh2qjmwAAABY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 206.189.89.22

🇸🇬 188.166.185.173

🇰🇷 222.121.250.203

🇰🇷 211.223.107.86

🇨🇳 182.141.149.214

🇺🇸 174.138.184.247

🇺🇸 162.216.150.189

🇺🇸 151.240.52.108

🇸🇬 146.190.103.103

🇺🇸 134.209.125.181

🇧🇷 129.121.47.136

🇭🇰 103.243.26.174

🇳🇱 102.129.200.117

🇺🇸 45.61.118.133

🇹🇳 41.230.66.122

🇬🇧 35.203.211.11

🇳🇱 176.65.149.236

🇧🇷 170.239.72.126

🇺🇸 162.216.149.32

🇺🇸 154.6.121.147