JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 2a0f:df00:0:255::199

2a0f:df00:0:255::199 was found in our database!

This IP was reported 144 times. Confidence of Abuse is 27%: ?

27%

Important Note: Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

ISP	KeFF Networks Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS41281
Domain Name	keff.org
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 2a0f:df00:0:255::199

Whois 2a0f:df00:0:255::199

IP Abuse Reports for 2a0f:df00:0:255::199:

This IP address has been reported a total of 144 times from 20 distinct sources. 2a0f:df00:0:255::199 was first reported on March 21st 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-06 04:16:57 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 00:16:54.019882 2026] [security2:error] [pid 10092:tid 10092] [client 2a0f:df00:0:255::199:54079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.compmansys.com"] [uri "/.git/config"] [unique_id "aiOfNrVz2t7RiSqkbubD1AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 14:38:22 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 10:38:16.334541 2026] [security2:error] [pid 12279:tid 12279] [client 2a0f:df00:0:255::199:9281] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.omintara.com"] [uri "/.git/config"] [unique_id "aiLfWEjAPrctDj2WYD7ZrgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 11:53:28 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:53:25.123675 2026] [security2:error] [pid 11365:tid 11365] [client 2a0f:df00:0:255::199:42577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.roigcorporativo.com"] [uri "/.git/config"] [unique_id "aiK4tXmPYkFmBj2M4m6ykgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-25 12:22:12 (1 week ago)	Blocked by UFW (TCP on 8333) Source port: 51031 Packet length: 72 This report (for 2a0f:df00:0000:0 ... show more Blocked by UFW (TCP on 8333) Source port: 51031 Packet length: 72 This report (for 2a0f:df00:0000:0255:0000:0000:0000:0199) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 ipblock.com	2026-05-23 19:47:00 (2 weeks ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-23 03:48:36 (2 weeks ago)	Blocked by UFW (TCP on 9999) Source port: 28935 Packet length: 72 This report (for 2a0f:df00:0000:0 ... show more Blocked by UFW (TCP on 9999) Source port: 28935 Packet length: 72 This report (for 2a0f:df00:0000:0255:0000:0000:0000:0199) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Ping of Death
🇺🇸 TPI-Abuse	2026-05-04 18:50:08 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:50:02.120440 2026] [security2:error] [pid 15818:tid 15818] [client 2a0f:df00:0:255::199:63463] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "microkerneltechnologies.com"] [uri "/wp-config.php.info"] [unique_id "afjqWiOv0pg05RHfFQEpYwAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-26 21:05:27 (1 month ago)	2026-04-26 08:01:05,405 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026- ... show more 2026-04-26 08:01:05,405 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 12:01:49,229 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 18:01:46,778 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 21:01:46,108 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-27 00:05:25,704 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 show less	Brute-Force
🇨🇭 4server	2026-04-15 01:08:58 (1 month ago)	[WedApr1503:08:54.0423122026][security2:error][pid1445867:tid1445885][client2a0f:df00:0:255::199:0]M ... show more [WedApr1503:08:54.0423122026][security2:error][pid1445867:tid1445885][client2a0f:df00:0:255::199:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"359\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"edelhaut.ch\"][uri\"/wp-content/plugins/contact-form-7/readme.txt\"][unique_id\"ad7lJoR4mbkGS9gHMbIT6QAAAUo\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 03:53:32 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 23:53:25.826592 2026] [security2:error] [pid 30079:tid 30079] [client 2a0f:df00:0:255::199:24521] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|atmoorehealthcare.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atmoorehealthcare.com"] [uri "/atmooreh.sql"] [unique_id "ac3oNbW8bUR5q41pPAVu3AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ketovoila.pl	2026-04-01 19:38:18 (2 months ago)	ketovoila.pl HONEYPOT traffic: count=2, paths=2; sample_path=ketovoila.pl/etovoila_com.sql; UA=Mozil ... show more ketovoila.pl HONEYPOT traffic: count=2, paths=2; sample_path=ketovoila.pl/etovoila_com.sql; UA=Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1; window=2026-04-01T18:56:05Z..2026-04-01T18:56:05Z show less	Port Scan Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-03-31 06:06:27 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 02:06:16.749495 2026] [security2:error] [pid 8488:tid 8488] [client 2a0f:df00:0:255::199:65317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.protonmultimedia.com"] [uri "/.git/config"] [unique_id "actkWBxgfq2YiiR185u0MwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-03-30 15:30:22 (2 months ago)	Blocked by UFW (TCP on 9999) Source port: 43579 Packet length: 72 This report (for 2a0f:df00:0000:0 ... show more Blocked by UFW (TCP on 9999) Source port: 43579 Packet length: 72 This report (for 2a0f:df00:0000:0255:0000:0000:0000:0199) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Ping of Death
🇺🇸 ipblock.com	2026-03-27 04:35:00 (2 months ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-03-27 01:06:53 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a940:302:118:0:43::

🇸🇬 2404:6800:4003:c1e::124

🇲🇽 186.96.145.241

🇮🇳 182.79.215.75

🇺🇸 172.237.150.127

🇬🇭 102.223.92.101

🇳🇱 93.123.109.114

🇧🇪 34.79.188.62

🇸🇬 203.116.129.55

🇧🇷 187.180.212.41

🇳🇱 155.117.6.32

127.0.0.1

🇰🇷 121.66.124.146

🇺🇸 64.227.49.223

🇨🇳 59.38.131.149

🇸🇬 47.84.142.211

🇺🇸 45.156.129.111

🇺🇸 45.43.57.53

🇮🇩 34.101.249.193

🇧🇪 34.62.39.214