JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a

2a0a:4cc0:c1:b656:44b:87ff:fef0:281a

Activity Trending Down IPv6 SLAAC Note

52 reports found in our database

39% ▼ ▼ ▼ Elevated

Abuse confidence score ?

ISP

netcup GmbH

Usage Type

Data Center/Web Hosting/Transit

ASN

AS197540

Domain Name

netcup.de

Country

🇩🇪 Germany

City

Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:

This IP address has been reported a total of 52 times from 16 distinct sources. 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a was first reported on June 24th 2026, and the most recent report was 2 weeks ago. In the last 60 days, the top reporter locations were: United States of America with 16 reports; France with 11 reports; Germany with 3 reports. The most common categories in these recent reports were: Bad Web Bot 24 times; Web App Attack 16 times; Brute-Force 15 times; DDoS Attack 8 times; Hacking 5 times; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-18 08:47:22 (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:210350) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 04:47:12.517440 2026] [security2:error] [pid 28652:tid 28652] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:5032] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|deindo.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "deindo.com"] [uri "/guestbook.html"] [unique_id "aoQcEE-0C8GXONeabeDWzwAAABI"], referer: http://deindo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 01:03:30 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:225170) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 21:03:22.114193 2026] [security2:error] [pid 10866:tid 10926] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:26128] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|trulyoriginalpurpleoctopus.art\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "trulyoriginalpurpleoctopus.art"] [uri "/wp-json/wp/v2/users"] [unique_id "aoJd2vkW5r9YnREbcDeG_wAAAII"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-16 23:12:27 (2 weeks ago)	Failed IMAP login	Hacking Brute-Force
🇺🇸 Vano Ganzzz	2026-08-14 14:29:35 (3 weeks ago)	Triggered Cloudflare WAF (l7ddos) from DE. Action taken: BLOCK ASN: 197540 (netcup GmbH) Protocol: H ... show more Triggered Cloudflare WAF (l7ddos) from DE. Action taken: BLOCK ASN: 197540 (netcup GmbH) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-08-14T14:29:35Z Ray ID: a2b0a70ddbe0ffcf UA: fasthttp show less	DDoS Attack Bad Web Bot
🇵🇱 Budyn	2026-08-14 07:20:52 (3 weeks ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dev.astropot.store \| URI: /.pypirc \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇫🇷 MatStef132	2026-08-12 11:19:41 (3 weeks ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-12 02:15:08 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:210492) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 22:15:01.040771 2026] [security2:error] [pid 2426565:tid 2426565] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:41860] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kinnaird.enterprises"] [uri "/.env.production.local"] [unique_id "anvXJblqNOyktcjk-zxZSAAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-09 21:07:24 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:210350) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 17:07:17.624679 2026] [security2:error] [pid 21424:tid 21424] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:24668] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|yaufung.naturev.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "yaufung.naturev.net"] [uri "/gbook/gbook.php"] [unique_id "anjsBXoa-kUrwW0maFrmfgAAAAU"], referer: http://yaufung.naturev.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-08-09 15:55:51 (3 weeks ago)	CrowdSec: lrob/ddos-homepage-flood	Hacking
🇺🇸 TPI-Abuse	2026-08-02 09:24:57 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:210350) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 02 05:24:48.678630 2026] [security2:error] [pid 1980486:tid 1980594] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:61320] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.whitecrosslibrary.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.whitecrosslibrary.com"] [uri "/"] [unique_id "am8M4G3f0itlj_xi7uUKLgAAAks"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 hghosting	2026-08-01 11:11:08 (1 month ago)	CrowdSec auto-report: crowdsecurity/nginx-req-limit-exceeded — 6 events	Brute-Force SSH
🇫🇷 mrcrassi	2026-07-31 22:56:46 (1 month ago)	Triggered Cloudflare WAF (firewallManaged) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (HEAD met ... show more Triggered Cloudflare WAF (firewallManaged) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (HEAD method) Endpoint: /.env.local UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇦🇷 pgimperiale	2026-07-30 16:50:00 (1 month ago)		DDoS Attack
🇺🇸 TPI-Abuse	2026-07-28 17:31:16 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:210492) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 13:31:07.292012 2026] [security2:error] [pid 386182:tid 386200] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:26710] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anthonydalessandro.com"] [uri "/.env.save"] [unique_id "amjnWx_uvcNCwOYEiVrpHgAAAQY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-28 08:45:40 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): ... show more (mod_security) mod_security (id:210492) triggered by 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 04:45:32.983471 2026] [security2:error] [pid 1596305:tid 1596305] [client 2a0a:4cc0:c1:b656:44b:87ff:fef0:281a:39892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "apexandroids.com"] [uri "/.env"] [unique_id "amhsLIQRPyqSdiFVqm0PDwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 136.66.58.205

🇮🇷 62.193.4.101

🇻🇳 14.248.83.33

🇬🇧 2620:171:6c:f002:9999::241

🇹🇼 220.132.197.23

🇺🇸 205.210.31.85

🇪🇹 196.191.212.232

🇺🇸 137.184.86.146

🇨🇳 119.99.255.61

🇨🇳 117.26.67.163

🇺🇸 104.196.57.212

🇮🇩 103.131.61.163

🇺🇸 103.73.52.148

🇨🇳 101.204.69.58

🇮🇳 68.183.95.102

🇰🇷 221.156.191.112

🇺🇸 205.210.31.83

🇺🇸 205.210.31.82

🇺🇸 205.210.31.80

🇺🇸 162.216.149.118