JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0b:f4c2::4

2a0b:f4c2::4 was found in our database!

This IP was reported 224 times. Confidence of Abuse is 34%: ?

34%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	Artikel10 e.V.
Usage Type	Fixed Line ISP
ASN	AS60729
Hostname(s)	berlin01.tor-exit.artikel10.org
Domain Name	artikel10.org
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0b:f4c2::4

Whois 2a0b:f4c2::4

IP Abuse Reports for 2a0b:f4c2::4:

This IP address has been reported a total of 224 times from 24 distinct sources. 2a0b:f4c2::4 was first reported on October 30th 2022, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-07-28 20:05:08 (3 days ago)	Blocked by UFW (TCP on 8333) Source port: 17836 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 17836 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0004) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇹🇷 neron	2026-07-26 19:50:51 (5 days ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-24 15:30:03 (1 week ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 10:24:56 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 2a0b:f4c2::4 (berlin01.tor-exit.artikel10.org): ... show more (mod_security) mod_security (id:210831) triggered by 2a0b:f4c2::4 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 06:24:48.034756 2026] [security2:error] [pid 3068:tid 3068] [client 2a0b:f4c2::4:61964] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.joshseipel.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.joshseipel.com"] [uri "/"] [unique_id "alixcKmmhJnrPOyGJaOEbQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 albionfreemarket.com	2026-07-08 15:04:20 (3 weeks ago)	2a0b:f4c2::4 - - [08/Jul/2026:15:04:19 +0000] "GET /pricecheck/T2_PLANKS,T3_PLANKS,T4_PLANKS,T4_PLAN ... show more 2a0b:f4c2::4 - - [08/Jul/2026:15:04:19 +0000] "GET /pricecheck/T2_PLANKS,T3_PLANKS,T4_PLANKS,T4_PLANKS_LEVEL1@1,T4_PLANKS_LEVEL2@2,T4_PLANKS_LEVEL3@3,T4_PLANKS_LEVEL4@4,T5_PLANKS,T5_PLANKS_LEVEL1@1,T5_PLANKS_LEVEL2@2,T5_PLANKS_LEVEL3@3,T5_PLANKS_LEVEL4@4,T6_PLANKS,T6_PLANKS_LEVEL1@1,T6_PLANKS_LEVEL2@2,T6_PLANKS_LEVEL3@3,T6_PLANKS_LEVEL4@4,T7_PLANKS,T7_PLANKS_LEVEL1@1,T7_PLANKS_LEVEL2@2,T7_PLANKS_LEVEL3@3,T7_PLANKS_LEVEL4@4,T8_PLANKS,T8_PLANKS_LEVEL1@1,T8_PLANKS_LEVEL2@2,T8_PLANKS_LEVEL3@3,T8_PLANKS_LEVEL4@4?tab=checker&c=3003%2C5003%2C2004%2C3005%2C4002%2C1002%2C3008%2C7&pt=sell&ad=15&cd=30&sa=1&DFeM=1838%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM%20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29%23 HTTP/2.0" 403 555 "https://albionfreemarket.com/pricecheck/T2_PLANKS,T3_PLANKS,T4_PLANKS,T4_PLANKS_LEVEL1@1,T4_PLANKS_LEVEL2@2,T4_PLA ... show less	SQL Injection Web App Attack
🇺🇸 xmission.com	2026-07-04 01:18:22 (4 weeks ago)	Blocked by UFW (TCP on 8333) Source port: 50866 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 50866 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0004) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 Skyrider	2026-07-03 11:19:28 (4 weeks ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-07-01 23:59:09 (4 weeks ago)	Blocked by UFW (TCP on 8333) Source port: 27112 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 27112 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0004) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-30 09:03:25 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 31566 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 31566 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0004) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇪🇸 gnom4ik	2026-06-28 04:50:18 (1 month ago)	ban-reviewer auto report; ip=2a0b:f4c2::4; scenario=http:scan; scenario_context=http:scan,tor-exit-n ... show more ban-reviewer auto report; ip=2a0b:f4c2::4; scenario=http:scan; scenario_context=http:scan,tor-exit-nodes; verdict=valid_ban; confidence=0.92; categories=14,15,18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high show less	Port Scan Hacking Brute-Force SSH
🇺🇸 xmission.com	2026-06-24 21:50:58 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 22116 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 22116 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0004) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-06-21 15:00:05 (1 month ago)	Blocked by UFW (TCP on 8333) Source port: 55204 Packet length: 80 This report (for 2a0b:f4c2:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 55204 Packet length: 80 This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0004) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-19 17:02:27 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::4 (berlin01.tor-exit.artikel10.org): ... show more (mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::4 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 13:02:22.113364 2026] [security2:error] [pid 17819:tid 17819] [client 2a0b:f4c2::4:31616] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|astglobalgroup.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "astglobalgroup.com"] [uri "/wordpress_tglobalgroup.sql"] [unique_id "ajV2HrnMW8_G4XE7xQhl8AAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 08:55:02 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::4 (berlin01.tor-exit.artikel10.org): ... show more (mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::4 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 04:54:57.251239 2026] [security2:error] [pid 10025:tid 10025] [client 2a0b:f4c2::4:30654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.feartheshear.com"] [uri "/.git/config"] [unique_id "aivJYd26KNwl8akQhlWoLgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Savvii	2026-06-10 08:48:47 (1 month ago)	22 attempts against mh-misbehave-ban on web-new	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 224 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.49

🇺🇸 195.184.76.48

🇩🇪 167.94.145.26

🇺🇸 166.62.41.190

🇺🇸 162.216.149.106

🇺🇸 150.107.38.146

🇨🇦 85.217.149.73

🇬🇧 35.203.211.107

🇨🇱 34.176.37.182

🇨🇳 218.13.214.18

🇰🇷 211.253.9.49

🇲🇶 188.115.65.220

🇻🇳 113.161.149.20

🇨🇳 111.113.88.94

🇻🇳 103.147.123.61

🇬🇧 45.133.173.58

🇧🇷 35.199.75.179

🇮🇩 34.101.82.164

🇺🇸 185.180.141.48

🇨🇳 183.23.62.106