JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0b:f4c2::28

2a0b:f4c2::28 was found in our database!

This IP was reported 233 times. Confidence of Abuse is 7%: ?

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Artikel10 e.V.
Usage Type	University/College/School
ASN	AS60729
Hostname(s)	berlin01.tor-exit.artikel10.org
Domain Name	artikel10.org
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0b:f4c2::28

Whois 2a0b:f4c2::28

IP Abuse Reports for 2a0b:f4c2::28:

This IP address has been reported a total of 233 times from 26 distinct sources. 2a0b:f4c2::28 was first reported on October 30th 2022, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-08-14 23:06:48 (1 month ago)	CrowdSec blocked: http:scan detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-08-10 22:29:21 (1 month ago)	CrowdSec blocked: http:scan detected via OPNsense firewall	Hacking Web App Attack
🇳🇱 MacLotsen	2026-08-02 19:09:23 (1 month ago)	berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:01 +0200] "POST /wp-login.php HTTP/1.1" 200 3 ... show more berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:01 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:03 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:06 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36" berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:08 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) Ap ... show less	Web App Attack Brute-Force
🇹🇷 neron	2026-07-29 18:19:38 (1 month ago)	CrowdSec blocked: http:scan detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-28 00:19:38 (1 month ago)	CrowdSec blocked: http:scan detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-26 17:50:52 (1 month ago)	CrowdSec blocked: http:scan detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-28 18:03:37 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 14:03:25.338599 2026] [security2:error] [pid 26853:tid 26853] [client 2a0b:f4c2::28:45548] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.sixsensehealing.com"] [uri "/.git/config"] [unique_id "akFh7axCmOuj1ahKqOdvlgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-26 19:02:05 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 15:01:58.468656 2026] [security2:error] [pid 31276:tid 31276] [client 2a0b:f4c2::28:2554] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.papelawfirm.com"] [uri "/.git/config"] [unique_id "aj7MpiesmQeIP1LClW7CbAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-06-23 12:17:28 (2 months ago)	Blocked by UFW (TCP on 8333) Source port: 44850 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 44850 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0028) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-18 17:50:07 (2 months ago)	Blocked by UFW (TCP on 8333) Source port: 28872 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 28872 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0028) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-17 11:05:54 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 07:05:43.999069 2026] [security2:error] [pid 12137:tid 12137] [client 2a0b:f4c2::28:33442] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.egass.info.networkmediasoftware.com"] [uri "/.git/config"] [unique_id "ajJ_h2BgugjrUL_xwdH_rwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Savvii	2026-06-10 09:41:55 (3 months ago)	20 attempts against mh-misbehave-ban on web-new	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 09:44:30 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org) ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::28 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 05:44:23.323649 2026] [security2:error] [pid 846:tid 846] [client 2a0b:f4c2::28:27104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.tbnkardesler.com"] [uri "/.git/config"] [unique_id "aiaO99wll6Cpmy6cs_FNjAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 stechusa	2026-05-25 23:08:48 (3 months ago)	ELEVATED_THREAT \| country=DE \| ASN=Stiftung Erneuerbare Freiheit \| AbuseIPDB=22% \| Facet request dur ... show more ELEVATED_THREAT \| country=DE \| ASN=Stiftung Erneuerbare Freiheit \| AbuseIPDB=22% \| Facet request during elevated threat (facet_ratio=0.70, unique_ips=144) \| Sequential facet path walking detected (5 paths in order) \| Sequential facet path walking detected (6 paths in order) show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-05-25 23:08:48 (3 months ago)	[Askari] \| country=DE \| Behavior: Concurrent page load during attack, HTTP/1.1 over TLS, Sequential ... show more [Askari] \| country=DE \| Behavior: Concurrent page load during attack, HTTP/1.1 over TLS, Sequential path crawling show less	Bad Web Bot DDoS Attack

Showing 1 to 15 of 233 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 188.124.228.197

🇮🇪 109.255.9.230

🇰🇷 106.245.151.118

🇮🇳 103.86.180.10

🇫🇷 91.231.89.7

🇺🇸 66.249.84.33

🇺🇸 57.141.20.0

🇺🇸 35.227.104.207

🇺🇸 35.226.21.5

🇺🇸 35.225.94.179

🇸🇬 2a12:f540:93c6:b1cd:546f:613b:8467:bf15

🇰🇷 220.95.40.69

🇻🇪 200.75.122.45

🇺🇸 193.29.62.63

🇺🇿 188.113.198.47

🇷🇺 185.46.197.79

🇭🇰 165.154.6.75

🇰🇷 112.185.230.208

🇺🇸 54.91.122.193

🇫🇮 35.228.85.141