JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627

2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 25%: ?

25%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	netcup GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197540
Domain Name	netcup.de
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627

Whois 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627

IP Abuse Reports for 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627:

This IP address has been reported a total of 16 times from 6 distinct sources. 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 was first reported on July 26th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-10-21 09:55:51 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.space \| URI: /.env \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-21 00:40:49 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sweetpuddingtrap.online \| URI: /wp-admin \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-10-20 18:10:44 (1 day ago)	slw-(visforms) : try to access forms...	Hacking
🇫🇷 conseilgouz	2026-10-20 04:48:12 (2 days ago)	scw-Joomla User : try to access forms...	Hacking
🇵🇱 Budyn	2026-10-16 02:28:02 (6 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dont-eat-the-pudding.xyz \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-15 17:36:38 (6 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dont-eat-the-pudding.online \| URI: /backup.sql \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-15 13:02:49 (6 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: definitelynotahoneypot.online \| URI: /backup.sql \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 conseilgouz	2026-10-15 07:51:31 (1 week ago)	cow-Joomla User : try to access forms...	Hacking
🇵🇱 Budyn	2026-10-14 21:50:29 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.top \| URI: /backup.sql \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-14 05:57:15 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.xyz \| URI: /.git/HEAD \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 SCHAPPY	2026-10-05 19:48:03 (2 weeks ago)	Excessive crawling, scraping, request limit exceeded, HTTP code 429.	Web App Attack
🇺🇸 TPI-Abuse	2026-09-12 03:59:37 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 (Unknown) ... show more (mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 23:59:29.904997 2026] [security2:error] [pid 18800:tid 18800] [client 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627:51526] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|tortoisehosting.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tortoisehosting.com"] [uri "/georgesmarina.com"] [unique_id "aqTOIVxeDn5CwUg0iVzaNQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-08-17 13:18:15 (2 months ago)	(modsecurity) srv104 ModSecurity 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 (DE/Germany/-): 30 in the las ... show more (modsecurity) srv104 ModSecurity 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 (DE/Germany/-): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-10 04:01:50 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 (Unknown) ... show more (mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 00:01:41.923385 2026] [security2:error] [pid 19990:tid 19990] [client 2a0a:4cc0:c2:a8f2:8426:b7ff:fe44:2627:38936] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|michaelhick.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "michaelhick.com"] [uri "/michaelhick.com"] [unique_id "anlNJa3aXix6iobWtgi4xwAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Lezetho	2026-08-03 11:00:31 (2 months ago)	DDoS, WebSpam, Web Attack, and Brute-force blocked by Cloudflare	DDoS Attack Email Spam Hacking Brute-Force

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 89.169.61.250

🇵🇰 72.255.26.55

🇫🇷 188.241.38.150

🇺🇸 165.22.41.116

🇯🇵 160.251.210.23

🇺🇿 144.124.192.94

🇷🇸 91.234.135.220

🇫🇷 86.212.95.40

🇺🇸 51.81.163.53

🇳🇬 41.76.82.2

🇫🇷 37.59.112.122

🇺🇸 195.184.76.142

🇪🇨 181.39.16.164

🇩🇪 159.69.196.50

🇺🇸 155.212.37.61

🇹🇼 111.70.32.201

🇨🇳 106.59.139.203

🇱🇹 62.60.130.234

🇺🇸 54.164.106.236

🇫🇷 51.254.136.153