AbuseIPDB » 2.26.122.20
2.26.122.20
This IP was reported 6 times. Confidence of
Abuse
is 20% : ?
ISP
VPSPay - vpspay.cloud
Usage Type
Data Center/Web Hosting/Transit
ASN
AS201988
Domain Name
vpspay.cloud
Country
🇫🇮
Finland
City
Helsinki, Uusimaa
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 2.26.122.20 :
This IP address has been reported a total of
6
times from
6 distinct
sources.
2.26.122.20 was first reported on
May 16th 2026 , and the most recent report was
4 weeks ago
Old Reports:
The most recent abuse report for this IP address is from
4 weeks ago
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇧🇪
melochef
2026-05-17 19:57:41
(4 weeks ago)
ModSecurity: Access denied with code 403 (phase 2). [id "941100"] [msg "XSS Attack Detected via libi ...
show more
ModSecurity: Access denied with code 403 (phase 2). [id "941100"] [msg "XSS Attack Detected via libinjection"] [severity "CRITICAL"] [tag "OWASP_CRS/4.0"] [hostname "waf.cdn-edge.net"] [uri "/manager/status"] [unique_id "faec990f5e5c91eb"]
2.26.122.20 - - [16/May/2026:11:54:23 +0000] "GET /manager/status HTTP/1.1" 403 1203 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
show less
Hacking
Web App Attack
🇸🇪
kmtnck
2026-05-17 19:19:57
(4 weeks ago)
Fail2Ban (traefik-auth): Ban 2.26.122.20 after 10 failures
2.26.122.20 - - [14/May/2026:15:30:19 +00 ...
show more
Fail2Ban (traefik-auth): Ban 2.26.122.20 after 10 failures
2.26.122.20 - - [14/May/2026:15:30:19 +0000] "GET /wp-config.php.bak HTTP/1.1" 404 53267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0"
2.26.122.20 - - [14/May/2026:15:30:19 +0000] "GET /db.sql HTTP/1.1" 403 8861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0"
show less
Web App Attack
🇺🇸
Gowtham A
2026-05-17 19:06:02
(4 weeks ago)
CrowdSec: crowdsecurity/http-crawl-non_statics
2.26.122.20 - - [14/May/2026:18:47:26 +0000] "GET /sh ...
show more
CrowdSec: crowdsecurity/http-crawl-non_statics
2.26.122.20 - - [14/May/2026:18:47:26 +0000] "GET /shell HTTP/1.1" 404 1643 "-" "curl/8.4.0"
17 alerts in 58s | Action: ban 4h
show less
Web App Attack
🇸🇰
Victor Hernandez
2026-05-17 00:46:44
(4 weeks ago)
Fail2Ban (traefik-botsearch): Ban 2.26.122.20 after 37 failures
2.26.122.20 - - [16/May/2026:12:51:3 ...
show more
Fail2Ban (traefik-botsearch): Ban 2.26.122.20 after 37 failures
2.26.122.20 - - [16/May/2026:12:51:35 +0000] "GET /wp-config.php~ HTTP/1.1" 404 33734 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
2.26.122.20 - - [16/May/2026:12:51:35 +0000] "GET /administrator/ HTTP/1.1" 403 6843 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
show less
Web App Attack
🇷🇴
soham bhore
2026-05-16 22:22:05
(4 weeks ago)
[**] [1:2024792:3] ET EXPLOIT Apache Struts Remote Code Execution [**]
[Classification: Attempted In ...
show more
[**] [1:2024792:3] ET EXPLOIT Apache Struts Remote Code Execution [**]
[Classification: Attempted Information Leak] [Priority: 2]
14/May/2026:14:26:35 +0000 {TCP} 2.26.122.20:45465 -> 10.3.90.167:443
show less
Hacking
🇷🇴
Jashuva P
2026-05-16 22:08:04
(4 weeks ago)
AS201988 VPSPay bulletproof hosting. Active in SNI spoofing, hosting phishing kits, C2 infrastructur ...
show more
AS201988 VPSPay bulletproof hosting. Active in SNI spoofing, hosting phishing kits, C2 infrastructure, and proxy/VPN abuse services.
show less
Hacking
Exploited Host
Showing 1 to
6
of 6 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: