JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a0f:df00:0:255::201

Recent Activity IPv6 SLAAC Note

Abuse Confidence Score

14% Caution

135 reports

21 reporters · latest 3 days ago

ISP: KeFF Networks Ltd
Usage Type: Data Center/Web Hosting/Transit
ASN: AS41281
Domain Name: keff.org
Country: 🇸🇪 Sweden
City: Stockholm, Stockholm

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

135 from 21 distinct reporters

First reported

November 29th 2022

Most recent report

3 days ago

Last 60 days

Top reporter locations 🇩🇪 Germany 1 🇵🇱 Poland 1

Most common categories Bad Web Bot 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2024-08-17 21:32:50 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 17 17:32:41.719932 2024] [security2:error] [pid 18297:tid 18297] [client 2a0f:df00 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 17 17:32:41.719932 2024] [security2:error] [pid 18297:tid 18297] [client 2a0f:df00:0:255::201:56423] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.robwhitson.com"] [uri "/.git/config"] [unique_id "ZsEW-WkvRo-q0nDZ8REL_AAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-07-30 05:34:24 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 30 01:34:17.602002 2024] [security2:error] [pid 4089819:tid 4089819] [client 2a0f: ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 30 01:34:17.602002 2024] [security2:error] [pid 4089819:tid 4089819] [client 2a0f:df00:0:255::201:34707] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.allseniorsolutions.com"] [uri "/.git/config"] [unique_id "Zqh7WR0IeG_RlxQXHZ4_QAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-07-21 02:15:03 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 20 22:14:56.005614 2024] [security2:error] [pid 9060:tid 9060] [client 2a0f:df00:0 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 20 22:14:56.005614 2024] [security2:error] [pid 9060:tid 9060] [client 2a0f:df00:0:255::201:12631] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hvacs-aircon.com"] [uri "/wp-config.php.uk"] [unique_id "ZpxvIBQjkzy1h9kpUoOJpAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-07-13 00:02:35 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 12 20:02:24.273472 2024] [security2:error] [pid 28136:tid 47826757248768] [client ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 12 20:02:24.273472 2024] [security2:error] [pid 28136:tid 47826757248768] [client 2a0f:df00:0:255::201:45383] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|joanagauer.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "joanagauer.com"] [uri "/contact/&/&/&/mailto:[email protected]"] [unique_id "ZpHEENqO7VqYOa8eKdj8mgAAARU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Linuxmalwarehuntingnl	2024-07-04 23:17:52 UTC · (2 years ago)	Honeypot HIT	Brute-Force
🇳🇱 Linuxmalwarehuntingnl	2024-06-28 22:54:04 UTC · (2 years ago)	Honeypot HIT	Brute-Force
🇺🇸 TPI-Abuse	2024-06-19 10:03:51 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 19 06:03:44.945139 2024] [security2:error] [pid 16223] [client 2a0f:df00:0:255::20 ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 19 06:03:44.945139 2024] [security2:error] [pid 16223] [client 2a0f:df00:0:255::201:47043] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|coolerboxes.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coolerboxes.com"] [uri "/wp.sql"] [unique_id "ZnKtAL51nt8BobPbWsF_bQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-05-15 00:16:08 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 14 20:16:00.615886 2024] [security2:error] [pid 27674] [client 2a0f:df00:0:255::20 ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 14 20:16:00.615886 2024] [security2:error] [pid 27674] [client 2a0f:df00:0:255::201:54229] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|letmespeakpodcast.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "letmespeakpodcast.com"] [uri "/etmespeakpodcast.sql"] [unique_id "ZkP-wOQNHUxf2x33pGBRiwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-05-14 08:02:30 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 14 04:02:24.024811 2024] [security2:error] [pid 17939] [client 2a0f:df00:0:255::20 ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 14 04:02:24.024811 2024] [security2:error] [pid 17939] [client 2a0f:df00:0:255::201:34965] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|genevaatlantic.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "genevaatlantic.com"] [uri "/evaatlantic.sql"] [unique_id "ZkMakMUX_6xvN45QNOCMAQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-04-17 05:26:01 UTC · (2 years ago)	(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 17 01:25:54.072487 2024] [security2:error] [pid 29729] [client 2a0f:df00:0:255::20 ... show more (mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 17 01:25:54.072487 2024] [security2:error] [pid 29729] [client 2a0f:df00:0:255::201:28455] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|transcapitalsolutions.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "transcapitalsolutions.com"] [uri "/transc.sql"] [unique_id "Zh9dYvjSymXJPCf_6DQ7lwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-03-29 02:52:59 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 22:52:55.073997 2024] [security2:error] [pid 27400] [client 2a0f:df00:0:255::20 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 22:52:55.073997 2024] [security2:error] [pid 27400] [client 2a0f:df00:0:255::201:50491] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.jvcsat.com"] [uri "/.git/config"] [unique_id "ZgYtB49q3QyoBMY8fto9vwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-03-29 02:07:04 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 22:07:00.206031 2024] [security2:error] [pid 23954] [client 2a0f:df00:0:255::20 ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 22:07:00.206031 2024] [security2:error] [pid 23954] [client 2a0f:df00:0:255::201:33643] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.webasketball.net"] [uri "/.git/config"] [unique_id "ZgYiRB47WHMp7yW7LBJ4UwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-03-28 21:35:25 UTC · (2 years ago)	(mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 17:35:20.148091 2024] [security2:error] [pid 1062407] [client 2a0f:df00:0:255:: ... show more (mod_security) mod_security (id:210492) triggered by 2a0f:df00:0:255::201 (Unknown): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 28 17:35:20.148091 2024] [security2:error] [pid 1062407] [client 2a0f:df00:0:255::201:22245] [client 2a0f:df00:0:255::201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.bisbyphotography.com"] [uri "/.git/config"] [unique_id "ZgXimE0sgw64ZklTSqqk0QAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2023-09-26 22:07:18 UTC · (3 years ago)	2023-09-26 20:53:39 /favicon.ico	Web App Attack
🇩🇪 Hobby Bob	2022-11-29 00:16:12 UTC · (3 years ago)	Nov 29 06:16:12 mail dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=, rip=2a0f:df00:0:255::201, lip=X.X.X.X session=	Port Scan Hacking

Showing 121 to 135 of 135 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇭 188.213.131.82

🇲🇽 177.232.87.239

🇨🇳 124.222.21.3

🇺🇸 91.230.168.147

🇳🇱 86.38.187.31

🇫🇷 217.71.127.125

🇹🇷 212.64.201.210

🇺🇸 195.184.76.124

🇨🇴 190.66.67.238

🇨🇭 188.213.131.254

🇨🇭 188.213.131.140

🇩🇪 185.220.100.247

🇺🇸 173.239.211.148

🇺🇸 172.245.90.204

🇺🇸 75.189.155.79

🇳🇱 195.178.110.30

🇨🇴 190.242.62.226

🇨🇭 188.213.131.173

🇩🇪 172.121.43.63

🇺🇸 136.65.48.202