JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0b:8bc0:2:196e::1

2a0b:8bc0:2:196e::1 was found in our database!

This IP was reported 206 times. Confidence of Abuse is 0%: ?

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	NextGenWebs, S.L.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS41608
Domain Name	nextgenwebs.es
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0b:8bc0:2:196e::1

Whois 2a0b:8bc0:2:196e::1

IP Abuse Reports for 2a0b:8bc0:2:196e::1:

This IP address has been reported a total of 206 times from 101 distinct sources. 2a0b:8bc0:2:196e::1 was first reported on April 16th 2026, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-06-23 05:52:11 (2 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇧🇷 Peregrine	2026-05-06 03:21:51 (3 months ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15 ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.backup HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.local HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.production HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /backend/.env HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.bak HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /.aws/credentials HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /laravel/.env HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /api/.env HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /.env HTTP/1.1" 404 414 show less	Bad Web Bot
🇩🇪 big-cloud.nl	2026-05-05 15:14:01 (3 months ago)	Try to access /app/.env	Web App Attack
🇩🇪 BlueWire Hosting	2026-05-05 13:51:33 (3 months ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇺🇸 ersei.net	2026-05-05 02:57:38 (3 months ago)	Brute force multiple 403s	Brute-Force
🇺🇸 itsnixk	2026-05-05 00:13:13 (3 months ago)	(mod_security) mod_security (id:930130) triggered by 2a0b:8bc0:2:196e::1 (Unknown): 1 in the last 36 ... show more (mod_security) mod_security (id:930130) triggered by 2a0b:8bc0:2:196e::1 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon May 04 20:13:08.982076 2026] [security2:error] [pid 804560:tid 804658] [client 2a0b:8bc0:2:196e::1:0] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "secrets.json" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.25.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/secrets.json"] [unique_id "afk2FKwuVh_eLJkaca3hVAAAAA8"] show less	Port Scan
🇳🇱 e.fierstra	2026-05-04 22:43:01 (3 months ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 Bedios GmbH	2026-05-04 17:31:54 (3 months ago)	Login credentials theft attempt	Hacking
🇩🇪 ecs.ge	2026-05-04 17:14:43 (3 months ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇩🇪 XICTRON	2026-05-04 12:15:03 (3 months ago)	ModSecurity rule violation detected by Fail2Ban	Web App Attack
🇺🇸 SodaAudit.app	2026-05-04 08:13:21 (3 months ago)	[sodaaudit.app] Web app attack. Timestamp: 2026-05-04T07:25:01.000Z. 2 probe events, 2 distinct path ... show more [sodaaudit.app] Web app attack. Timestamp: 2026-05-04T07:25:01.000Z. 2 probe events, 2 distinct path(s). Paths (payload): /.env, /.aws/credentials show less	Web App Attack
🇧🇷 Peregrine	2026-05-04 03:17:24 (3 months ago)	Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15 ... show more Fail2Ban Jail s2: tomcat-honeypot \| Evidence: 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.backup HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.local HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.production HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /backend/.env HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.112 - - [18/Apr/2026:15:20:29 -0300] "GET /.env.bak HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /.aws/credentials HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /laravel/.env HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /api/.env HTTP/1.1" 404 414 2a0b:8bc0:2:196e::1 104.23.166.113 - - [18/Apr/2026:15:20:29 -0300] "GET /.env HTTP/1.1" 404 414 show less	Bad Web Bot
🇬🇧 andypiper	2026-05-04 01:02:12 (3 months ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇫🇷 debaba	2026-05-04 00:30:52 (3 months ago)	[04/May/2026:00:30:51.854535 +0000] affou92MsWrPVV36OEASsAAAAMY 2a0b:8bc0:2:196e::1 47090 127.0.0.1 ... show more [04/May/2026:00:30:51.854535 +0000] affou92MsWrPVV36OEASsAAAAMY 2a0b:8bc0:2:196e::1 47090 127.0.0.1 7080 [04/May/2026:00:30:52.205319 +0000] affovJP3D ... show less	Brute-Force Web App Attack
🇩🇪 dbmwebdesign	2026-05-04 00:10:46 (3 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack

Showing 1 to 15 of 206 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.182

🇧🇬 46.233.17.219

🇲🇴 182.93.7.194

🇺🇦 176.122.120.60

🇺🇸 172.233.208.124

🇧🇷 138.0.142.5

🇳🇱 85.11.167.111

🇷🇴 80.94.92.109

🇱🇹 213.176.26.191

🇺🇸 198.148.31.1

🇨🇱 191.116.99.179

🇧🇷 187.9.247.58

🇺🇸 154.17.139.133

🇨🇳 113.214.239.53

🇮🇩 112.78.177.237

🇫🇷 92.154.95.236

🇳🇱 91.92.47.232

🇺🇸 62.101.183.242

🇬🇧 2620:171:fa:f0::237

🇸🇬 194.61.40.175