JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.229.248

216.26.229.248 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.229.248

Whois 216.26.229.248

IP Abuse Reports for 216.26.229.248:

This IP address has been reported a total of 25 times from 9 distinct sources. 216.26.229.248 was first reported on September 27th 2025, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ne1for23	2026-02-09 23:14:44 (3 months ago)	Attempting to probe for sensitive information accidently exposed via git config. 216.26.229.248 - - ... show more Attempting to probe for sensitive information accidently exposed via git config. 216.26.229.248 - - [09/Feb/2026:23:13:45 +0000] "GET /test/.git/config HTTP/1.1" 403 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" show less	Hacking
🇮🇹 VHosting	2025-12-24 03:00:14 (5 months ago)	Detected attack and reported by a human	DDoS Attack Brute-Force Bad Web Bot Exploited Host Web App Attack SSH
Anonymous	2025-12-22 18:06:37 (5 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-12-04 19:03:07 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 14:02:23.466779 2025] [security2:error] [pid 10256:tid 10256] [client 216.26.229.248:43701] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "actionplanner.xyz"] [uri "/.env"] [unique_id "aTHav3jZo_r5xzlaG92tpgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 09:18:19 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:18:11.755271 2025] [security2:error] [pid 10610:tid 10610] [client 216.26.229.248:26593] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.pulsepowermeter.com"] [uri "/.svn/wc.db"] [unique_id "aSQi057espWHtitkTivq2AAAACg"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2025-11-24 08:43:21 (6 months ago)	Attempted access to sensitive endpoint (/.svn/wc.db) detected. Automated scan or unauthorized probin ... show more Attempted access to sensitive endpoint (/.svn/wc.db) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:18:44 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:18:37.201953 2025] [security2:error] [pid 29510:tid 29510] [client 216.26.229.248:30131] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.ptfea.org"] [uri "/.env"] [unique_id "aSPqrVV8ZgCBxSoAxBTmOgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-16 20:01:08 (6 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.16 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.16 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-14 11:48:21 (6 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-11-13 03:48:26 (6 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.11.13 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.11.13 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-06 20:17:39 (6 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.06 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.06 is noted in report timestamp show less	Hacking Brute-Force
🇨🇦 wil.com	2025-10-18 08:07:08 (7 months ago)	GlobalProtect login attempts with user chewk.	VPN IP Brute-Force
Anonymous	2025-10-14 01:09:46 (7 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.14 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.14 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-10-09 08:19:11 (7 months ago)	(mod_security) mod_security (id:210350) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 216.26.229.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 09 04:19:07.025096 2025] [security2:error] [pid 23277:tid 23277] [client 216.26.229.248:53831] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|192.64.150.248:443\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "192.64.150.248"] [uri "/"] [unique_id "aOdv-6qFQL3axwF-NdlHpQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇹 urnilxfgbez	2025-10-08 22:45:00 (7 months ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 194.180.232.50

🇩🇪 167.94.146.37

🇭🇰 165.154.70.130

🇨🇿 82.118.30.94

🇺🇸 64.236.143.32

🇷🇺 46.163.144.31

🇺🇸 216.25.89.123

🇺🇸 208.84.100.18

🇲🇽 187.249.60.130

🇱🇧 185.206.200.145

🇫🇮 147.185.133.157

🇱🇹 141.98.9.88

🇸🇬 98.159.43.16

🇺🇸 74.125.183.146

🇩🇪 54.37.74.179

🇳🇱 45.142.193.12

🇺🇸 40.77.167.62

🇬🇧 5.226.140.88

🇬🇧 195.206.182.213

🇨🇦 176.113.74.89