This IP was reported 36 times. Confidence of
Abuse
is 84%: ?
84%
Important Note: Public IPv6 addresses may implement the SLAAC
privacy extension. With this, the interface identifier is randomly generated. The SLAAC
privacy extension also implements a time out, which is configurable, so that the IPv6
interface addresses will be discarded and a new interface identifier is generated.
This IP address has been reported a total of
36
times from
21 distinct
sources.
2a06:a880:5:a919::1 was first reported on
, and the most recent report was
.
Old Reports:
The most recent abuse report for this IP address is from
. It is possible that this IP is no longer involved in abusive activities.
{"ClientAddr":"104.23.166.7:12129","ClientHost":"2a06:a880:5:a919::1","ClientPort":"12129","ClientUs ...
show more{"ClientAddr":"104.23.166.7:12129","ClientHost":"2a06:a880:5:a919::1","ClientPort":"12129","ClientUsername":"-","DownstreamContentSize":24,"DownstreamStatus":404,"Duration":835286,"OriginContentSize":24,"OriginDuration":684122,"OriginStatus":404,"Overhead":151164,"RequestAddr":"sftp.timvdberg.dev","RequestContentSize":0,"RequestCount":152041,"RequestHost":"sftp.timvdberg.dev","RequestMethod":"GET","RequestPath":"/.env","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"sftpgo@docker","ServiceAddr":"172.16.16.11:8080","ServiceName":"sftpgo@docker","ServiceURL":"http://172.16.16.11:8080","StartLocal":"2026-06-04T20:24:35.427788873Z","StartUTC":"2026-06-04T20:24:35.427788873Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"https","level":"info","msg":"","request_Cf-Connecting-Ip":"2a06:a880:5:a919::1","request_X-Forwarded-For":"2a06:a880:5:a919::1","request_X-Real-Ip":"104.23.166.7","time":"2026-06-04T20:24:35Z
...
show less
(modsecurity) srv102 ModSecurity 2a06:a880:5:a919::1 (NL/The Netherlands/-): 10 in the last 3600 sec ...
show more(modsecurity) srv102 ModSecurity 2a06:a880:5:a919::1 (NL/The Netherlands/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show moreAuto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-02.
show less
(modsecurity) srv103 ModSecurity 2a06:a880:5:a919::1 (NL/The Netherlands/-): 10 in the last 3600 sec ...
show more(modsecurity) srv103 ModSecurity 2a06:a880:5:a919::1 (NL/The Netherlands/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
Showing 1 to
15
of 36 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩