JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

2a13:7c00:5:23:f816:3eff:febb:2748

Recent Activity IPv6 SLAAC Note

Abuse confidence score ?

80% Critical

18 reports

13 reporters · latest 6 hours ago

ISP	as56971 network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS56971
Domain Name	as56971.net
Country	🇫🇷 France
City	Paris, Ile-de-France

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 2a13:7c00:5:23:f816:3eff:febb:2748

Export CSV

This IP address has been reported a total of 18 times from 13 distinct sources. 2a13:7c00:5:23:f816:3eff:febb:2748 was first reported on October 14th 2026, and the most recent report was 6 hours ago. In the last 60 days, the top reporter locations were: United States of America with 6 reports; Germany with 4 reports; Netherlands with 3 reports. The most common categories in these recent reports were: Web App Attack 15 times; Bad Web Bot 10 times; Brute-Force 8 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 Anytech	2026-10-16 03:58:38 (6 hours ago)	Blocked by ConnMonitor	Web App Attack
🇺🇸 TPI-Abuse	2026-10-16 01:53:06 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 ... show more (mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 21:52:59.193415 2026] [security2:error] [pid 7321:tid 7321] [client 2a13:7c00:5:23:f816:3eff:febb:2748:37940] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tijuana-bibles.com"] [uri "/.git/config"] [unique_id "atGDe4e2EAp3-HkrUIc44wAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 Peregrine	2026-10-15 15:14:45 (19 hours ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: 2a13:7c00:5:23:f816:3eff:febb:2748 104.23.229.94 - - [15/ ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: 2a13:7c00:5:23:f816:3eff:febb:2748 104.23.229.94 - - [15/Oct/2026:12:14:34 -0300] "GET /.git/HEAD HTTP/1.1" 404 414 show less	Bad Web Bot
🇳🇱 BlueWire Hosting	2026-10-15 14:27:22 (20 hours ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇧🇷 ICS Labs	2026-10-15 13:44:51 (20 hours ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-15 UTC.	Brute-Force
Anonymous	2026-10-15 13:35:42 (20 hours ago)	Web probing (2 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CR ... show more Web probing (2 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON. show less	Web App Attack
🇩🇪 pltcldvlpr	2026-10-15 12:32:25 (22 hours ago)	CMS/framework probe: 2a13:7c00:5:23:f816:3eff:febb:2748 - - [15/Oct/2026:14:32:25 +0200] "GET /.git/ ... show more CMS/framework probe: 2a13:7c00:5:23:f816:3eff:febb:2748 - - [15/Oct/2026:14:32:25 +0200] "GET /.git/config HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0: Win64: x64: rv:140.0) Gecko/20100101 Firefox/140.0" asn=56971 org="CGI GLOBAL LIMITED" country=FR ... show less	Web App Attack
Anonymous	2026-10-15 11:24:16 (23 hours ago)	[15/Oct/2026:14:22:31 +0300] 179206335187.561634 2a13:7c00:5:23:f816:3eff:febb:2748 42648 2a01:4f8:2 ... show more [15/Oct/2026:14:22:31 +0300] 179206335187.561634 2a13:7c00:5:23:f816:3eff:febb:2748 42648 2a01:4f8:202:41d3::2 80 [15/Oct/2026:14:24:15 +0300] 179206345590.956015 2a13:7c00:5:23:f816:3eff:febb:2748 34602 2a01:4f8:202:41d3::2 443 show less	Web App Attack
🇩🇪 ghostwarriors	2026-10-15 02:50:10 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-15 01:21:04 (1 day ago)	[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 2a13:7c00:5:23:f816:3eff:febb:2748 - - [15/Oct/2026:03:20:50 +0200] "GET /.git/logs/HEAD HTTP/1.1" 301 462 "-" "Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 21:03:50 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 ... show more (mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 17:03:45.443721 2026] [security2:error] [pid 21469:tid 21469] [client 2a13:7c00:5:23:f816:3eff:febb:2748:46400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lusineweb.com"] [uri "/.git/config"] [unique_id "as_uMTk11NQp4zg2MdGKewAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 19:20:00 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 ... show more (mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 15:19:56.053695 2026] [security2:error] [pid 16461:tid 16461] [client 2a13:7c00:5:23:f816:3eff:febb:2748:48814] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nancyscafeandcatering.com"] [uri "/.env"] [unique_id "as_V3GcBAXqFH4Jjjt8TVwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 sefinek.net	2026-10-14 19:08:06 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from FR. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇳🇱 Mangelot Hosting	2026-10-14 18:29:34 (1 day ago)	(web_sensitive_file) srv103 Sensitive file probe (.env/.git/backup) 2a13:7c00:5:23:f816:3eff:febb:27 ... show more (web_sensitive_file) srv103 Sensitive file probe (.env/.git/backup) 2a13:7c00:5:23:f816:3eff:febb:2748 (FR/France/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-14 13:08:35 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 ... show more (mod_security) mod_security (id:210492) triggered by 2a13:7c00:5:23:f816:3eff:febb:2748 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 09:08:31.634498 2026] [security2:error] [pid 4892:tid 4892] [client 2a13:7c00:5:23:f816:3eff:febb:2748:36348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tell-me-first.com"] [uri "/.env"] [unique_id "as9-z-gE-Zfwc5HvvMblxAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 184.105.247.195

🇻🇳 157.66.47.161

🇺🇸 65.49.1.77

🇺🇸 50.114.236.21

🇺🇸 205.210.31.71

🇷🇴 193.46.255.86

🇦🇷 181.209.75.90

🇲🇳 180.149.126.13

🇺🇸 166.62.41.96

🇳🇱 161.35.81.115

🇫🇷 91.196.152.36

🇫🇷 91.196.152.33

🇺🇸 66.132.224.91

🇺🇸 23.234.107.178

🇨🇳 221.13.86.155

🇺🇸 205.210.31.70

🇺🇸 205.210.31.65

🇹🇳 196.176.161.179

🇳🇱 193.47.62.69

🇲🇽 177.229.197.38