JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.249.58

216.26.249.58 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 14%: ?

14%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.249.58

Whois 216.26.249.58

IP Abuse Reports for 216.26.249.58:

This IP address has been reported a total of 20 times from 12 distinct sources. 216.26.249.58 was first reported on November 14th 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 pcouy	2026-10-23 03:57:46 (1 hour ago)	Obvious bot patterns with spoofed User-agent : Mozilla/5.0 (Linux; Android 15; Pixel 9 Pro) AppleWeb ... show more Obvious bot patterns with spoofed User-agent : Mozilla/5.0 (Linux; Android 15; Pixel 9 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36 ... show less	Bad Web Bot
🇫🇷 pcouy	2026-10-20 05:35:47 (2 days ago)	Obvious bot patterns with spoofed User-agent : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (K ... show more Obvious bot patterns with spoofed User-agent : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 ... show less	Bad Web Bot
🇨🇭 SOC [GOLINE SA]	2026-09-03 13:43:01 (1 month ago)	[RoutePulse \| 2026-09-03T13:43:01Z \| RTBH-INJECTED] ATTACK CLASS: vpn_bruteforce SOURCE: 216.26.249. ... show more [RoutePulse \| 2026-09-03T13:43:01Z \| RTBH-INJECTED] ATTACK CLASS: vpn_bruteforce SOURCE: 216.26.249.58 · AS200373 Drei-K-Tech-GmbH 3xK Tech GmbH EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — distributed attack (6 attempts/15min) DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring ACTION: BGP null route injected at RoutePulse network edge show less	Brute-Force Hacking
🇳🇱 Savvii	2026-08-31 04:14:53 (1 month ago)	20 attempts against mh_ha-misbehave-ban on yeti	Brute-Force Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-08-17 06:30:25 (2 months ago)	2026-08-17 @ 08:30:25 (CET) ~ Blocked for trying to access: /wp-login.php	Web App Attack
🇫🇷 Sklurk	2026-08-02 03:06:05 (2 months ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-08-01 01:02:38 (2 months ago)	Web App Attack	Web App Attack
🇫🇷 pm33	2026-07-17 00:53:24 (3 months ago)	Wordpress login attempts	Brute-Force
🇬🇧 Oakley	2026-07-15 15:18:29 (3 months ago)	(confirmed_bot_sig) Confirmed bot	Hacking
🇲🇹 Malta	2026-07-12 12:57:33 (3 months ago)	216.26.249.58 - - [12/Jul/2026:14:57:33 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; ... show more 216.26.249.58 - - [12/Jul/2026:14:57:33 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" show less	Hacking Web App Attack
🇺🇸 lostswordfish.com	2026-07-09 09:36:03 (3 months ago)	Wordfence waf block on fairregistry	Web App Attack
Anonymous	2026-01-05 20:10:49 (9 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:50 (9 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-11-24 09:28:01 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.249.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 216.26.249.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:27:54.653098 2025] [security2:error] [pid 26074:tid 26074] [client 216.26.249.58:18481] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "warbonnetmusic.tremulant.com"] [uri "/.git/HEAD"] [unique_id "aSQlGsF8DXu9HXdp7Wch6QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:45:05 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.249.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 216.26.249.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:44:53.930248 2025] [security2:error] [pid 13940:tid 13965] [client 216.26.249.58:9819] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "j-and-t.jd-web-designs.com"] [uri "/.git/HEAD"] [unique_id "aSQM9VcEhUGiZJQ6jyqxFQAAAM4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 200.138.46.131

🇲🇽 187.251.123.104

🇺🇸 185.180.141.9

🇺🇸 178.128.152.206

🇰🇷 125.143.200.150

🇩🇪 69.5.169.6

🇧🇷 201.28.234.10

🇺🇸 195.184.76.52

🇳🇱 185.226.197.69

🇫🇮 147.185.133.35

🇨🇳 106.59.139.1

🇺🇸 104.179.96.152

🇮🇩 103.138.68.158

🇨🇦 51.222.110.150

🇵🇱 45.138.12.78

🇬🇧 2a06:4880:4000::56

🇻🇳 210.245.30.140

🇺🇸 209.50.161.236

🇹🇷 176.88.138.215

🇯🇴 176.29.231.135