JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0b:f4c2::28

2a0b:f4c2::28 was found in our database!

This IP was reported 222 times. Confidence of Abuse is 28%: ?

28%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Artikel10 e.V.
Usage Type	Commercial
ASN	AS60729
Hostname(s)	berlin01.tor-exit.artikel10.org
Domain Name	artikel10.org
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0b:f4c2::28

Whois 2a0b:f4c2::28

IP Abuse Reports for 2a0b:f4c2::28:

This IP address has been reported a total of 222 times from 25 distinct sources. 2a0b:f4c2::28 was first reported on October 30th 2022, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Savvii	2026-06-10 09:41:55 (4 days ago)	20 attempts against mh-misbehave-ban on web-new	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 09:44:30 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:44:23.323649 2026] [security2:error] [pid 846:tid 846] [client 2a0b:f4c2::28:27104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.tbnkardesler.com"] [uri "/.git/config"] [unique_id "aiaO99wll6Cpmy6cs_FNjAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 stechusa	2026-05-25 23:08:48 (2 weeks ago)	ELEVATED_THREAT \| country=DE \| ASN=Stiftung Erneuerbare Freiheit \| AbuseIPDB=22% \| Facet request dur ... show more ELEVATED_THREAT \| country=DE \| ASN=Stiftung Erneuerbare Freiheit \| AbuseIPDB=22% \| Facet request during elevated threat (facet_ratio=0.70, unique_ips=144) \| Sequential facet path walking detected (5 paths in order) \| Sequential facet path walking detected (6 paths in order) show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-05-25 23:08:48 (2 weeks ago)	[Askari] \| country=DE \| Behavior: Concurrent page load during attack, HTTP/1.1 over TLS, Sequential ... show more [Askari] \| country=DE \| Behavior: Concurrent page load during attack, HTTP/1.1 over TLS, Sequential path crawling show less	Bad Web Bot DDoS Attack
🇺🇸 TPI-Abuse	2026-05-25 13:52:51 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 09:52:44.425682 2026] [security2:error] [pid 13418:tid 13418] [client 2a0b:f4c2::28:23368] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barigby.com"] [uri "/.git/"] [unique_id "ahRULHym3v14ZmkKMVNRsAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-09 17:45:44 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 13:45:37.549028 2026] [security2:error] [pid 32594:tid 32594] [client 2a0b:f4c2::28:55958] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cliniquecavalancia.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cliniquecavalancia.com"] [uri "/cliniquecavalan.sql"] [unique_id "af9ywf9Zzuh9-cy2Kd46ygAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-04-29 00:24:36 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 1460 Packet length: 80 This report (for 2a0b:f4c2:0000:00 ... show more Blocked by UFW (TCP on 8333) Source port: 1460 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0028) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-04-26 21:04:37 (1 month ago)	2026-04-26 08:00:55,172 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0b:f4c2::28 2026-04-26 1 ... show more 2026-04-26 08:00:55,172 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0b:f4c2::28 2026-04-26 12:01:42,547 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0b:f4c2::28 2026-04-26 18:01:40,198 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0b:f4c2::28 2026-04-26 21:01:39,461 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0b:f4c2::28 2026-04-27 00:04:33,632 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0b:f4c2::28 show less	Brute-Force
🇺🇸 xmission.com	2026-04-23 07:29:41 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 32204 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 32204 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0028) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-04-20 10:24:21 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 20 06:24:13.094469 2026] [security2:error] [pid 2918660:tid 2918660] [client 2a0b:f4c2::28:46622] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.menzelassociates.com"] [uri "/.git/config"] [unique_id "aeX-zdmWY-jiQ5AH4x55LgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-04-16 06:30:58 (1 month ago)	[ThuApr1608:30:54.4106642026][security2:error][pid3862185:tid3862417][client2a0b:f4c2::28:0]ModSecur ... show more [ThuApr1608:30:54.4106642026][security2:error][pid3862185:tid3862417][client2a0b:f4c2::28:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"359\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"cadvending.ch\"][uri\"/wp-content/plugins/elementor/readme.txt\"][unique_id\"aeCCHmhMD4AAFAtMsVGuIgAAAMU\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-13 03:53:04 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 12 23:52:57.185797 2026] [security2:error] [pid 4038310:tid 4038310] [client 2a0b:f4c2::28:4174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "honweneedthis.com"] [uri "/wp-config.phpold"] [unique_id "adxomW-12sjaN4wQaegz_QAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-08 16:50:44 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 12:50:36.635120 2026] [security2:error] [pid 3015886:tid 3015886] [client 2a0b:f4c2::28:63920] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brbvip.com"] [uri "/wp-config.phpbak"] [unique_id "adaHXD-TxKI0MYOMaVpsVAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 20:50:56 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 16:50:49.681747 2026] [security2:error] [pid 3357:tid 3357] [client 2a0b:f4c2::28:41332] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|edgecomix.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "edgecomix.com"] [uri "/edgeco.sql"] [unique_id "ac7WqTfGLiYtWEphuE_l9AAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 03:53:17 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 23:53:08.581726 2026] [security2:error] [pid 28650:tid 28650] [client 2a0b:f4c2::28:44036] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|atmoorehealthcare.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atmoorehealthcare.com"] [uri "/e_com.sql"] [unique_id "ac3oJDuXyhFq-XmYgHWAmQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 222 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 221.162.3.119

🇨🇳 218.59.201.12

🇳🇱 192.253.248.17

🇮🇩 103.110.34.131

🇨🇦 34.130.125.137

🇦🇺 34.129.153.90

🇩🇪 192.109.200.175

🇨🇳 120.85.115.25

🇸🇬 103.250.10.18

🇨🇳 39.154.229.131

🇷🇺 178.178.213.129

🇫🇮 147.185.133.48

🇮🇩 103.101.216.26

🇫🇷 77.237.239.101

🇱🇹 77.90.185.80

🇺🇸 64.236.140.210

🇺🇸 34.106.199.228

🇮🇩 34.101.230.193

🇺🇸 34.16.171.199

🇰🇷 14.55.31.113