JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0c:9f00:a000:9ea7::1

2a0c:9f00:a000:9ea7::1 was found in our database!

This IP was reported 50 times. Confidence of Abuse is 86%: ?

86%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	RARE MOOD AGENCY SRL
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14315
Domain Name	raremood.agency
Country	🇺🇸 United States of America
City	Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0c:9f00:a000:9ea7::1

Whois 2a0c:9f00:a000:9ea7::1

IP Abuse Reports for 2a0c:9f00:a000:9ea7::1:

This IP address has been reported a total of 50 times from 20 distinct sources. 2a0c:9f00:a000:9ea7::1 was first reported on June 17th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-21 22:16:31 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 18:16:25.817157 2026] [security2:error] [pid 13064:tid 13064] [client 2a0c:9f00:a000:9ea7::1:51318] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|auguststoten.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "auguststoten.com"] [uri "/wp-content/debug.log"] [unique_id "ajhiuaHTaMpXZq6CkfXRcgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-06-21 22:00:06 (1 week ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-21 21:52:38 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 17:52:30.277503 2026] [security2:error] [pid 8558:tid 8558] [client 2a0c:9f00:a000:9ea7::1:45428] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|atame.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atame.com"] [uri "/wp-content/debug.log"] [unique_id "ajhdHvULkJ1JTMPK-9heNAAAAE8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 21:30:42 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 17:30:37.075007 2026] [security2:error] [pid 4319:tid 4319] [client 2a0c:9f00:a000:9ea7::1:36336] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asiabeef.network"] [uri "/api/.env"] [unique_id "ajhX_RWHzW0u2e9G-Zm8hgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 21:10:07 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 17:09:58.277790 2026] [security2:error] [pid 1890:tid 1890] [client 2a0c:9f00:a000:9ea7::1:53354] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.arteseros.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.arteseros.com"] [uri "/wp-content/debug.log"] [unique_id "ajhTJkdZiZbFmUi8AB6JpQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Major Hostility	2026-06-21 21:07:24 (1 week ago)	"GET /wp-content/debug.log HTTP/1.1" 404 "GET /application.yml HTTP/1.1" 404 "GET /.env HTTP/1.1" 40 ... show more "GET /wp-content/debug.log HTTP/1.1" 404 "GET /application.yml HTTP/1.1" 404 "GET /.env HTTP/1.1" 404 "GET /.env.example HTTP/1.1" 404 "GET /.aws/credentials HTTP/1.1" 404 "GET /secrets.json HTTP/1.1" 404 "GET /secrets.yml HTTP/1.1" 404 "GET /api/.env HTTP/1.1" 404 show less	Web App Attack
🇩🇪 todix	2026-06-21 20:41:39 (1 week ago)	WebAttack or semilar from 2a0c:9f00:a000:9ea7::1	Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 20:39:36 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 16:39:32.372662 2026] [security2:error] [pid 4323:tid 4323] [client 2a0c:9f00:a000:9ea7::1:36844] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "archaiusmusic.com"] [uri "/api/.env"] [unique_id "ajhMBOeFP2QAs1J5DyQgAAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 19:54:29 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 15:54:24.096934 2026] [security2:error] [pid 10263:tid 10263] [client 2a0c:9f00:a000:9ea7::1:43584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anthearodgers.com"] [uri "/.env"] [unique_id "ajhBcFLwHtk4vgZhu8iJlQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 19:23:31 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 15:23:23.509199 2026] [security2:error] [pid 20556:tid 20556] [client 2a0c:9f00:a000:9ea7::1:39074] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amybeam.com"] [uri "/.env"] [unique_id "ajg6K4JsVAMBMb6ux8cUwAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 19:05:57 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 15:05:52.690018 2026] [security2:error] [pid 4969:tid 4969] [client 2a0c:9f00:a000:9ea7::1:35872] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazinghydraulics.com"] [uri "/api/.env"] [unique_id "ajg2EHabgO5y5mxQsciOZwAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 18:45:50 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210730) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 14:45:45.178454 2026] [security2:error] [pid 30880:tid 30880] [client 2a0c:9f00:a000:9ea7::1:54640] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|alphazeta.net\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alphazeta.net"] [uri "/wp-content/debug.log"] [unique_id "ajgxWQZg6Gd9NqY1FUdBuAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 18:30:24 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 14:30:20.404913 2026] [security2:error] [pid 28979:tid 28979] [client 2a0c:9f00:a000:9ea7::1:46194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.allisonbtaylor.com"] [uri "/.env.example"] [unique_id "ajgtvDCu9ubIxKb6vQEwGAAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 18:14:24 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 2a0c:9f00:a000:9ea7::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 14:14:20.375536 2026] [security2:error] [pid 10144:tid 10144] [client 2a0c:9f00:a000:9ea7::1:56922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.al-harbi.com"] [uri "/.env"] [unique_id "ajgp_K0KSC7i5qAYjAWRUwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-21 17:58:41 (1 week ago)	[SunJun2119:58:39.1013152026][security2:error][pid222249:tid222311][client2a0c:9f00:a000:9ea7::1:0]M ... show more [SunJun2119:58:39.1013152026][security2:error][pid222249:tid222311][client2a0c:9f00:a000:9ea7::1:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"mail.albertiarnaldoluigi.ch\"][uri\"/wp-content/debug.log\"][unique_id\"ajgmT75GKNIHCYX8N_u6twAAAQI\"] show less	Port Scan Brute-Force Web App Attack

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 222.222.124.164

🇳🇱 185.224.128.16

🇦🇷 149.78.61.52

🇦🇷 149.78.46.1

🇧🇳 119.160.166.237

🇧🇩 103.145.74.136

🇳🇱 85.121.54.44

🇨🇳 222.89.138.40

🇰🇷 220.121.38.45

🇲🇽 187.191.48.4

🇺🇸 162.216.149.202

🇲🇦 154.146.238.122

🇦🇷 149.78.57.4

🇦🇷 149.78.52.24

🇦🇷 149.78.50.44

🇮🇳 122.183.38.157

🇷🇴 92.118.39.49

🇷🇺 91.144.158.62

🇮🇹 77.32.49.226

🇭🇰 47.83.135.14