JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f

2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f was found in our database!

This IP was reported 29 times. Confidence of Abuse is 29%: ?

29%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	netcup GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197540
Domain Name	netcup.de
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f

Whois 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f

IP Abuse Reports for 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f:

This IP address has been reported a total of 29 times from 14 distinct sources. 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f was first reported on July 17th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 SCHAPPY	2026-10-23 09:42:03 (4 days ago)	Excessive crawling, scraping, request limit exceeded, HTTP code 429.	Web App Attack
🇵🇱 Budyn	2026-10-23 06:57:58 (4 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.site \| URI: /.env \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0 \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4eed9b2987d750a-HAM","Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,\/;q=0.8","Accept-Language":"en show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 15:17:53 (5 days ago)	(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f (Unknown): ... show more (mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 11:17:49.080263 2026] [security2:error] [pid 12153:tid 12153] [client 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f:38838] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|steinmetzjewelers.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "steinmetzjewelers.com"] [uri "/alsetsystems.com"] [unique_id "atopHbjPTBwu10770_-SnQAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-21 09:56:08 (6 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.space \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-21 00:41:15 (6 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sweetpuddingtrap.online \| URI: /.git/HEAD \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-18 00:44:26 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.site \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-17 16:07:45 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.website \| URI: /wp-admin \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-17 06:53:25 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.tech \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-16 23:59:10 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.store \| URI: /.git/HEAD \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 conseilgouz	2026-10-16 03:54:12 (1 week ago)	dow-Joomla User : try to access forms...	Hacking
🇺🇸 TPI-Abuse	2026-10-15 21:06:56 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f (Unknown): ... show more (mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 17:06:52.241863 2026] [security2:error] [pid 9724:tid 9724] [client 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f:54364] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|citystreetsalon.com\|F\|2"] [data ".fionnardesign.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "citystreetsalon.com"] [uri "/www.fionnardesign.com"] [unique_id "atFAbIoMPHID503EkcNdsgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-15 14:32:59 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: definitelynotahoneypot.top \| URI: /backup.sql \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-14 05:57:10 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.xyz \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-10-14 00:58:20 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.tech \| URI: /wp-admin \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-24 18:41:49 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f (Unknown): ... show more (mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 14:41:43.681236 2026] [security2:error] [pid 10330:tid 10330] [client 2a0a:4cc0:c2:adc2:2466:2ff:fefc:70f:44160] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.djbadger.com\|F\|2"] [data ".radiosro.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.djbadger.com"] [uri "/radiosro/www.radiosro.com"] [unique_id "arVu5-OPQpYRz9IFQOI76QAAABI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇨 200.24.157.206

🇺🇸 140.99.190.241

🇩🇪 109.160.32.115

🇺🇸 68.67.112.0

🇺🇸 66.132.159.116

🇳🇱 64.205.72.165

🇧🇪 34.79.59.9

🇦🇺 20.211.122.120

🇨🇳 14.103.107.29

🇮🇩 202.152.201.166

🇮🇳 182.70.254.196

🇺🇸 134.33.67.79

🇨🇳 113.200.238.158

🇮🇩 69.5.20.205

🇰🇷 20.194.27.148

🇹🇭 2405:9800:b521:2e35:a4be:25f8:e4b:e847

🇬🇧 185.247.137.221

🇨🇳 180.165.45.184

🇵🇪 161.132.53.75

🇺🇸 129.121.140.71