This IP address has been reported a total of
4
times from
2 distinct
sources.
116.203.26.27 was first reported on
March 12th 2025 , and the most recent report was
2 days ago Greece
with 3
reports.
The only category in these recent reports was:
Port Scan
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇬🇷
setupgr
2026-10-07 21:18:04
(2 days ago)
(mod_security) mod_security (id:11000011) triggered by 116.203.26.27 (DE/Germany/Bavaria/Nuremberg/- ...
show more
(mod_security) mod_security (id:11000011) triggered by 116.203.26.27 (DE/Germany/Bavaria/Nuremberg/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Oct 08 00:18:02.414063 2026] [security2:error] [pid 2986:tid 3136] [client 116.203.26.27:45076] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.27.26.203.116.clients.your-server.de"] [severity "CRITICAL"] [hostname "ftiaxtomonosou.gr"] [uri "/"] [unique_id "asa3CS5B-97OsM8OyZynMQAAAwk"]
show less
Port Scan
🇬🇷
setupgr
2026-10-06 23:17:51
(3 days ago)
(mod_security) mod_security (id:11000011) triggered by 116.203.26.27 (DE/Germany/Bavaria/Nuremberg/- ...
show more
(mod_security) mod_security (id:11000011) triggered by 116.203.26.27 (DE/Germany/Bavaria/Nuremberg/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Oct 07 02:17:49.648331 2026] [security2:error] [pid 1055659:tid 1055794] [client 116.203.26.27:46496] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.27.26.203.116.clients.your-server.de"] [severity "CRITICAL"] [hostname "ftiaxtomonosou.gr"] [uri "/"] [unique_id "asWBnV5CtZRKi7yc58U7rQAABVM"]
show less
Port Scan
🇬🇷
setupgr
2026-10-06 01:18:13
(4 days ago)
(mod_security) mod_security (id:11000011) triggered by 116.203.26.27 (DE/Germany/Bavaria/Nuremberg/- ...
show more
(mod_security) mod_security (id:11000011) triggered by 116.203.26.27 (DE/Germany/Bavaria/Nuremberg/-/[AS24940 Hetzner Online GmbH]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Oct 06 04:18:10.551612 2026] [security2:error] [pid 1055381:tid 1055540] [client 116.203.26.27:54784] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "clients.your-server.de" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: static.27.26.203.116.clients.your-server.de"] [severity "CRITICAL"] [hostname "ftiaxtomonosou.gr"] [uri "/"] [unique_id "asRMUTM8SazTZDFglbnmbQAABA4"]
show less
Port Scan
🇺🇸
TPI-Abuse
2025-03-12 06:57:03
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 116.203.26.27 (static.27.26.203.116.clients.you ...
show more
(mod_security) mod_security (id:210730) triggered by 116.203.26.27 (static.27.26.203.116.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 12 02:56:56.747482 2025] [security2:error] [pid 465857:tid 465857] [client 116.203.26.27:60490] [client 116.203.26.27] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||etemcolak.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "etemcolak.com"] [uri "/[email protected] "] [unique_id "Z9EwOCrJuN2FF0OYsgXJBgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
4
of 4 reports
