JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a0f:df00:0:255::199

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

14% Caution

160 reports

24 reporters · latest 3 days ago

ISP: KeFF Networks Ltd
Usage Type: Data Center/Web Hosting/Transit
ASN: AS41281
Domain Name: keff.org
Country: 🇸🇪 Sweden
City: Stockholm, Stockholm

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

160 from 24 distinct reporters

First reported

March 21st 2024

Most recent report

3 days ago

Last 60 days

Top reporter locations 🇩🇪 Germany 2

Most common categories Web App Attack 2 Brute-Force 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Savvii	2026-06-10 08:38:17 UTC · (4 months ago)	20 attempts against mh-misbehave-ban on web-new	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-06 04:16:57 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 00:16:54.019882 2026] [security2:error] [pid 10092:tid 10092] [client 2a0f:df00 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 00:16:54.019882 2026] [security2:error] [pid 10092:tid 10092] [client 2a0f:df00:0:255::199:54079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.compmansys.com"] [uri "/.git/config"] [unique_id "aiOfNrVz2t7RiSqkbubD1AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 14:38:22 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 10:38:16.334541 2026] [security2:error] [pid 12279:tid 12279] [client 2a0f:df00 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 10:38:16.334541 2026] [security2:error] [pid 12279:tid 12279] [client 2a0f:df00:0:255::199:9281] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.omintara.com"] [uri "/.git/config"] [unique_id "aiLfWEjAPrctDj2WYD7ZrgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 11:53:28 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:53:25.123675 2026] [security2:error] [pid 11365:tid 11365] [client 2a0f:df00 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:53:25.123675 2026] [security2:error] [pid 11365:tid 11365] [client 2a0f:df00:0:255::199:42577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.roigcorporativo.com"] [uri "/.git/config"] [unique_id "aiK4tXmPYkFmBj2M4m6ykgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-25 12:22:12 UTC · (5 months ago)	Blocked by UFW (TCP on 8333) Source port: 51031 Packet length: 72 This report (for 2a0f:df00:0000:0255:0000:0000:0000:0199) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇺🇸 ipblock.com	2026-05-23 19:47:00 UTC · (5 months ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-23 03:48:36 UTC · (5 months ago)	Blocked by UFW (TCP on 9999) Source port: 28935 Packet length: 72 This report (for 2a0f:df00:0000:0255:0000:0000:0000:0199) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan Ping of Death
🇺🇸 TPI-Abuse	2026-05-04 18:50:08 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:50:02.120440 2026] [security2:error] [pid 15818:tid 15818] [client 2a0f:df00 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 04 14:50:02.120440 2026] [security2:error] [pid 15818:tid 15818] [client 2a0f:df00:0:255::199:63463] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "microkerneltechnologies.com"] [uri "/wp-config.php.info"] [unique_id "afjqWiOv0pg05RHfFQEpYwAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-26 21:05:27 UTC · (6 months ago)	2026-04-26 08:01:05,405 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 12:01:49,229 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 18:01:46,778 fail2ban.actions [7718]: NOTI ... show more 2026-04-26 08:01:05,405 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 12:01:49,229 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 18:01:46,778 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-26 21:01:46,108 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 2026-04-27 00:05:25,704 fail2ban.actions [7718]: NOTICE [tor] Ban 2a0f:df00:0:255::199 show less	Brute-Force
🇨🇭 4server	2026-04-15 01:08:58 UTC · (6 months ago)	[WedApr1503:08:54.0423122026][security2:error][pid1445867:tid1445885][client2a0f:df00:0:255::199:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[ ... show more [WedApr1503:08:54.0423122026][security2:error][pid1445867:tid1445885][client2a0f:df00:0:255::199:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"359\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"edelhaut.ch\"][uri\"/wp-content/plugins/contact-form-7/readme.txt\"][unique_id\"ad7lJoR4mbkGS9gHMbIT6QAAAUo\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 03:53:32 UTC · (7 months ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 23:53:25.826592 2026] [security2:error] [pid 30079:tid 30079] [client 2a0f:df00 ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 23:53:25.826592 2026] [security2:error] [pid 30079:tid 30079] [client 2a0f:df00:0:255::199:24521] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|atmoorehealthcare.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atmoorehealthcare.com"] [uri "/atmooreh.sql"] [unique_id "ac3oNbW8bUR5q41pPAVu3AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ketovoila.pl	2026-04-01 19:38:18 UTC · (7 months ago)	ketovoila.pl HONEYPOT traffic: count=2, paths=2; sample_path=ketovoila.pl/etovoila_com.sql; UA=Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1; window=2026-04-0 ... show more ketovoila.pl HONEYPOT traffic: count=2, paths=2; sample_path=ketovoila.pl/etovoila_com.sql; UA=Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1; window=2026-04-01T18:56:05Z..2026-04-01T18:56:05Z show less	Port Scan Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-03-31 06:06:27 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 02:06:16.749495 2026] [security2:error] [pid 8488:tid 8488] [client 2a0f:df00:0 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::199 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 02:06:16.749495 2026] [security2:error] [pid 8488:tid 8488] [client 2a0f:df00:0:255::199:65317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.protonmultimedia.com"] [uri "/.git/config"] [unique_id "actkWBxgfq2YiiR185u0MwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-03-30 15:30:22 UTC · (7 months ago)	Blocked by UFW (TCP on 9999) Source port: 43579 Packet length: 72 This report (for 2a0f:df00:0000:0255:0000:0000:0000:0199) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan Ping of Death
🇺🇸 ipblock.com	2026-03-27 04:35:00 UTC · (7 months ago)	IPBlock protected site ID [3717-sec]. Robotic site crawling, undeclared spider	Bad Web Bot Web App Attack

Showing 16 to 30 of 160 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 199.165.159.117

🇷🇺 178.130.141.195

🇨🇳 121.15.7.100

🇧🇩 103.159.2.113

100.86.55.15

🇹🇭 43.152.244.145

🇨🇳 43.138.156.225

🇮🇱 34.165.154.24

🇷🇴 2.57.122.150

🇺🇸 2a10:4a05:9748:135d:bee0:ec10:d708:9e2e

🇪🇸 217.154.188.213

🇺🇸 147.185.132.86

🇰🇷 121.137.82.50

🇺🇸 76.125.234.140

🇷🇺 62.217.186.22

🇳🇱 45.148.10.151

🇳🇱 45.115.26.20

🇧🇩 37.111.253.167

🇧🇪 35.210.193.50

🇮🇹 194.60.213.98