JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0b:f4c2::20

2a0b:f4c2::20 was found in our database!

This IP was reported 229 times. Confidence of Abuse is 21%: ?

21%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Artikel10 e.V.
Usage Type	Fixed Line ISP
ASN	AS60729
Hostname(s)	berlin01.tor-exit.artikel10.org
Domain Name	artikel10.org
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0b:f4c2::20

Whois 2a0b:f4c2::20

IP Abuse Reports for 2a0b:f4c2::20:

This IP address has been reported a total of 229 times from 32 distinct sources. 2a0b:f4c2::20 was first reported on October 14th 2022, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-07-29 02:19:38 (2 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-28 02:19:38 (3 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-26 19:50:51 (4 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-25 08:27:07 (6 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇵🇱 sefinek.net	2026-06-26 19:50:47 (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from T1. Action: BLOCK \| Protocol: HTTP/2 (GET) \| Endpoint ... show more Triggered Cloudflare WAF (firewallCustom) from T1. Action: BLOCK \| Protocol: HTTP/2 (GET) \| Endpoint: / \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-23 12:31:06 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 08:30:57.826111 2026] [security2:error] [pid 32045:tid 32045] [client 2a0b:f4c2::20:11902] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.americombccs.com"] [uri "/.git/config"] [unique_id "ajp8gf3aWKwph4y5EqtJ5AAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-15 19:14:38 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 42352 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 42352 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0020) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-12 03:19:39 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 23:19:29.997440 2026] [security2:error] [pid 18141:tid 18141] [client 2a0b:f4c2::20:32578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.pnwdso.org"] [uri "/.git/config"] [unique_id "ait6wUBMsSytf9bm5xo6aQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-06-11 20:29:00 (1 month ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-07 22:04:32 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 10510 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 10510 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0020) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-05 10:53:07 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 06:52:57.165424 2026] [security2:error] [pid 7313:tid 7313] [client 2a0b:f4c2::20:36380] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.fvsllc.com"] [uri "/.git/config"] [unique_id "aiKqicYw1Zeg8Wpmq142jgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 05:19:19 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 01:19:13.837989 2026] [security2:error] [pid 15906:tid 15906] [client 2a0b:f4c2::20:10034] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|christianconsulting.net\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "christianconsulting.net"] [uri "/stianconsulting_com.sql"] [unique_id "agAVUbTLC061jnaLcBYQegAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-09 08:26:47 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 04:26:41.650237 2026] [security2:error] [pid 10232:tid 10232] [client 2a0b:f4c2::20:24722] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|kaldaragroup.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kaldaragroup.com"] [uri "/kaldaragroup_com.sql"] [unique_id "af7vwTixH5Ig8k7mlb_ZbwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-08 16:47:05 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::20 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 12:46:51.405326 2026] [security2:error] [pid 27196:tid 27196] [client 2a0b:f4c2::20:51960] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|brexitop.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "brexitop.com"] [uri "/backupwp.sql"] [unique_id "af4Te5P0w2JKsig34dzBlgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 gnom4ik	2026-05-03 03:33:27 (2 months ago)	ban-reviewer auto report; ip=2a0b:f4c2::20; scenario=http:scan; verdict=valid_ban; confidence=0.92; ... show more ban-reviewer auto report; ip=2a0b:f4c2::20; scenario=http:scan; verdict=valid_ban; confidence=0.92; categories=14,15,18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high show less	Port Scan Hacking Brute-Force SSH

Showing 1 to 15 of 229 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 147.185.132.77

🇬🇧 217.146.80.103

🇮🇳 216.10.242.215

🇮🇳 206.189.131.243

🇺🇸 198.98.62.211

🇭🇰 152.32.171.184

🇭🇰 103.194.106.230

🇺🇸 2604:a880:400:d0::24e2:b001

🇧🇷 189.6.20.205

🇪🇸 185.167.90.241

🇺🇦 185.5.254.91

🇫🇮 147.185.133.190

🇺🇸 45.132.115.82

🇬🇧 217.146.80.120

🇲🇲 203.81.93.222

🇫🇷 195.154.59.122

🇳🇱 192.253.248.215

🇩🇪 185.242.3.226

🇺🇸 147.185.132.39

🇰🇪 105.27.148.94