JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.249.185

216.26.249.185 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 35%: ?

35%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.249.185

Whois 216.26.249.185

IP Abuse Reports for 216.26.249.185:

This IP address has been reported a total of 14 times from 10 distinct sources. 216.26.249.185 was first reported on November 2nd 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇹 neo72	2026-07-13 10:54:21 (3 days ago)	Detected malicious activity - bulk block	Brute-Force Web App Attack
🇲🇹 Malta	2026-07-12 12:58:43 (4 days ago)	216.26.249.185 - - [12/Jul/2026:14:58:43 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; ... show more 216.26.249.185 - - [12/Jul/2026:14:58:43 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-07-10 11:47:04 (6 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇮🇹 Francesco Ippoliti	2026-07-05 02:58:29 (1 week ago)	[Jul 5 04:58:28] NOTICE[66068] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:400@154 ... show more [Jul 5 04:58:28] NOTICE[66068] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '216.26.249.185:47473' (callid: a62893c49a281031e17ef56dc86e57ce) - No matching endpoint found [Jul 5 04:58:28] NOTICE[64812] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '216.26.249.185:47473' (callid: a62893c49a281031e17ef56dc86e57ce) - No matching endpoint found ... show less	Brute-Force Port Scan
🇮🇹 Francesco Ippoliti	2026-07-03 22:01:17 (1 week ago)	[Jul 4 00:01:16] NOTICE[66068] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:701@154 ... show more [Jul 4 00:01:16] NOTICE[66068] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '216.26.249.185:65086' (callid: 36b71728f8456921124ffa644bf29c4d) - No matching endpoint found [Jul 4 00:01:16] NOTICE[64812] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '216.26.249.185:65086' (callid: 36b71728f8456921124ffa644bf29c4d) - No matching endpoint found ... show less	Brute-Force Port Scan
🇫🇮 sgofferj	2026-07-03 20:03:16 (1 week ago)	Attack attempt on SIP server	Fraud VoIP Hacking Brute-Force
🇫🇷 Sklurk	2026-06-20 02:07:30 (3 weeks ago)	Web App Attack	Web App Attack
🇲🇹 Malta	2026-06-20 01:46:57 (3 weeks ago)	216.26.249.185 - - [20/Jun/2026:03:46:57 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintos ... show more 216.26.249.185 - - [20/Jun/2026:03:46:57 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:46 (6 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-11-24 09:39:33 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.249.185 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.249.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:39:12.996016 2025] [security2:error] [pid 18088:tid 18088] [client 216.26.249.185:47595] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.avrknives.com"] [uri "/.git/HEAD"] [unique_id "aSQnwGUErAcl7mB7vr2SnQAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:28:38 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.249.185 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.249.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:28:34.863206 2025] [security2:error] [pid 21353:tid 21353] [client 216.26.249.185:33561] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "askthetarot.cards"] [uri "/.env"] [unique_id "aSQJIhDZhQveHcy1keKeUQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:11:05 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.249.185 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.249.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:10:59.669874 2025] [security2:error] [pid 15331:tid 15331] [client 216.26.249.185:35377] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.carlosmol.com"] [uri "/.git/HEAD"] [unique_id "aSPa04l1TXafeUsVOwjUIgAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-24 03:13:09 (7 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2025-11-02 18:05:43 (8 months ago)	This IP was involved in an brute force and password spray attack on 2025/11/02 07:23:25	Port Scan Brute-Force Exploited Host Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 85.217.149.50

🇺🇸 73.10.203.172

🇺🇸 2607:f8b0:4004:1009::12d

🇨🇳 221.234.36.123

🇷🇺 217.150.47.21

🇧🇪 198.235.24.249

🇪🇹 196.191.142.67

🇨🇴 190.27.102.109

🇿🇦 185.132.186.67

🇵🇱 176.53.159.197

🇵🇭 154.18.197.35

🇩🇪 152.233.21.9

🇵🇭 120.29.90.76

🇸🇬 114.119.153.132

🇱🇹 77.90.185.10

🇩🇪 69.5.169.87

🇩🇪 69.5.169.81

🇩🇪 64.89.163.77

🇨🇳 60.166.82.137

🇰🇷 59.15.64.97