JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a0b:8bc0:2:e2fc::1

Neutral Activity IPv6 SLAAC Note

Abuse confidence score ?

0% Low Risk

106 reports

60 reporters · latest 3 months ago

ISP	NextGenWebs, S.L.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS41608
Domain Name	nextgenwebs.es
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

2a0b:8bc0:2:e2fc::1 has been reported 106 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 2a0b:8bc0:2:e2fc::1

This IP address has been reported a total of 106 times from 60 distinct sources. 2a0b:8bc0:2:e2fc::1 was first reported on April 27th 2026, and the most recent report was 3 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 BlueWire Hosting	2026-06-08 06:58:50 (3 months ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇩🇪 big-cloud.nl	2026-06-08 05:05:43 (3 months ago)	Try to access /.git/HEAD	Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 04:22:32 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:8bc0:2:e2fc::1 (Unknown): 1 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:8bc0:2:e2fc::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 00:22:25.811891 2026] [security2:error] [pid 12101:tid 12101] [client 2a0b:8bc0:2:e2fc::1:34736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atsgroup.llc.myllc.email"] [uri "/backend/.env"] [unique_id "aiZDgail3xUNKTbaHvgBcAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 wordpresshosting.solutions	2026-06-08 04:13:13 (3 months ago)	Web app vulnerability scanning detected. Evidence: 2a0b:8bc0:2:e2fc::1 - - [08/Jun/2026:04:13:11 +00 ... show more Web app vulnerability scanning detected. Evidence: 2a0b:8bc0:2:e2fc::1 - - [08/Jun/2026:04:13:11 +0000] "GET /.env HTTP/1.1" 404 5569 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 2a0b:8bc0:2:e2fc::1 - - [08/Jun/2026:04:13:12 +0000] "GET /.aws/credentials HTTP/1.1" 404 776 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" show less	Web App Attack
🇳🇱 Site.eu	2026-06-07 18:48:27 (3 months ago)	Excessive multi-domain requests	Brute-Force
🇬🇧 openstrike.co.uk	2026-05-06 05:13:37 (4 months ago)	8 attacks on config grabbing URLs (type 2), env grabbing URLs, password grabbing URLs: GET /secrets. ... show more 8 attacks on config grabbing URLs (type 2), env grabbing URLs, password grabbing URLs: GET /secrets.json HTTP/1.1 GET /backend/.env HTTP/1.1 GET /.aws/credentials HTTP/1.1 show less	Hacking
🇺🇸 itsnixk	2026-05-05 15:07:15 (4 months ago)	(mod_security) mod_security (id:930130) triggered by 2a0b:8bc0:2:e2fc::1 (Unknown): 1 in the last 36 ... show more (mod_security) mod_security (id:930130) triggered by 2a0b:8bc0:2:e2fc::1 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue May 05 11:07:10.114430 2026] [security2:error] [pid 813837:tid 814312] [client 2a0b:8bc0:2:e2fc::1:49400] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "secrets.json" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.25.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/secrets.json"] [unique_id "afoHnio8jC4NV-lXvcsRngAAAI4"] show less	Port Scan
Anonymous	2026-05-05 13:10:07 (4 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇷 debaba	2026-05-05 09:55:11 (4 months ago)	[05/May/2026:09:55:11.266051 +0000] afm-f1gHwaAT5VS7jPfn_wAAAE4 2a0b:8bc0:2:e2fc::1 54170 127.0.0.1 ... show more [05/May/2026:09:55:11.266051 +0000] afm-f1gHwaAT5VS7jPfn_wAAAE4 2a0b:8bc0:2:e2fc::1 54170 127.0.0.1 7080 [05/May/2026:09:55:11.266231 +0000] afm-f1gHw ... show less	Brute-Force Web App Attack
🇫🇮 as211431.net	2026-05-05 06:41:02 (4 months ago)	Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.aws/credentials UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇭 4server	2026-05-05 05:52:11 (4 months ago)	[TueMay0507:52:05.7866322026][security2:error][pid1026191:tid1026484][client2a0b:8bc0:2:e2fc::1:0]Mo ... show more [TueMay0507:52:05.7866322026][security2:error][pid1026191:tid1026484][client2a0b:8bc0:2:e2fc::1:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.hostingedominio.com\"][uri\"/.env\"][unique_id\"afmFhSDsH8lmAhy_08pl-wAAAQ4\"] show less	Hacking Web App Attack
🇬🇧 openstrike.co.uk	2026-05-05 05:13:29 (4 months ago)	8 attacks on config grabbing URLs (type 2), password grabbing URLs, env grabbing URLs: GET /secrets. ... show more 8 attacks on config grabbing URLs (type 2), password grabbing URLs, env grabbing URLs: GET /secrets.json HTTP/1.1 GET /.aws/credentials HTTP/1.1 GET /app/.env HTTP/1.1 show less	Hacking
🇩🇪 gadix	2026-05-05 05:12:00 (4 months ago)	[05/May/2026:07:11:59.745114 +0200] afl8HwpMN87g-Y8VTCl35QAAAAQ 2a0b:8bc0:2:e2fc::1 53212 127.0.0.1 ... show more [05/May/2026:07:11:59.745114 +0200] afl8HwpMN87g-Y8VTCl35QAAAAQ 2a0b:8bc0:2:e2fc::1 53212 127.0.0.1 7081 [05/May/2026:07:11:59.747218 +0200] afl8H964ArZxSpaxfBStAQAAAAk 2a0b:8bc0:2:e2fc::1 53196 127.0.0.1 7081 [05/May/2026:07:11:59.801325 +0200] afl8H0Cj6-8Tn2XH0V46xgAAAAg 2a0b:8bc0:2:e2fc::1 53220 127.0.0.1 7081 ... show less	Web App Attack
🇩🇪 crypto i trust, hold i must	2026-05-05 05:01:42 (4 months ago)	Web scanner path: /.aws/credentials	Web App Attack
🇩🇪 AetherFox	2026-05-05 01:36:43 (4 months ago)	AetherFox VoidGuard detected: [Tue May 05 01:36:31.438901 2026] [authz_core:error] [pid 2530652:tid ... show more AetherFox VoidGuard detected: [Tue May 05 01:36:31.438901 2026] [authz_core:error] [pid 2530652:tid 2530675] [client 2a0b:8bc0:2:e2fc::1:28060] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.php/reg.html, referer: http://event.draconigen.net/ [Tue May 05 01:36:32.598947 2026] [authz_core:error] [pid 2530652:tid 2530691] [client 2a0b:8bc0:2:e2fc::1:28060] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.php/reg.html.env.production, referer: https://event.draconigen.net/.env.production [Tue May 05 01:36:35.638761 2026] [authz_core:error] [pid 2530652:tid 2530699] [client 2a0b:8bc0:2:e2fc::1:28080] AH01630: client denied by server configuration: proxy:https://[MASKED]/index.php/reg.html.env.local, referer: https://event.draconigen.net/.env.local [Tue May 05 01:36:36.105722 2026] [authz_core:error] [pid 2530652:tid 2530688] [client 2a0b:8bc0:2:e2fc::1:28060] AH01630: client denied by server configuration ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 106 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 200.69.21.47

🇹🇼 198.235.24.110

🇺🇸 162.216.150.11

🇨🇳 139.212.249.51

🇮🇳 130.210.44.52

🇧🇷 118.26.105.52

🇳🇱 109.160.32.96

🇫🇷 85.217.140.46

🇺🇸 74.82.47.15

🇩🇪 69.5.169.8

🇺🇸 64.23.172.115

🇱🇹 62.60.130.253

🇲🇿 41.94.111.190

🇦🇷 181.45.132.96

🇫🇷 172.234.162.107

🇳🇱 138.226.239.234

🇨🇳 123.187.243.243

🇺🇸 66.132.195.53

🇸🇬 47.79.206.157

🇳🇱 45.148.10.157