AbuseIPDB » 216.26.252.56
216.26.252.56
This IP was reported 9 times. Confidence of
Abuse
is 12% : ?
ISP
3xK Tech GmbH
Usage Type
Data Center/Web Hosting/Transit
ASN
AS200373
Domain Name
3xktech.cloud
Country
🇩🇪
Germany
City
Berlin, State of Berlin
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 216.26.252.56 :
This IP address has been reported a total of
9
times from
5 distinct
sources.
216.26.252.56 was first reported on
October 29th 2025 , and the most recent report was
6 days ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇧🇪
cmbplf
2026-06-01 12:37:19
(6 days ago)
4.959 requests with url.path //xmlrpc.php
4.216 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇨🇭
4server
2026-05-19 10:53:36
(2 weeks ago)
[TueMay1912:53:31.9220292026][security2:error][pid869458:tid869475][client216.26.252.56:0]ModSecurit ...
show more
[TueMay1912:53:31.9220292026][security2:error][pid869458:tid869475][client216.26.252.56:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\bhttpx\\\\\\\\b\|\\\\\\\\bnaabu\\\\\\\\b\|\\\\\\\\bffuf\\\\\\\\b\|\\\\\\\\bgobuster\\\\\\\\b\|\\\\\\\\bferoxbuster\\\\\\\\b\|\\\\\\\\bwfuzz\\\\\\\\b\|\\\\\\\\bjaeles\\\\\\\\b\|\\\\\\\\bzgrab2\?\\\\\\\\b\|\\\\\\\\bcommix\\\\\\\\b\|\\\\\\\\bxsstrike\\\\\\\\b\|\\\\\\\\bkiterunner\\\\\\\\b\|\(\?:\^\|[/]\)katana\(\?:/\|\\\\\\\\b\)\|\\\\\\\\bkr/\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"70\"][id\"338800\"][rev\"2\"][msg\"Atomicorp.comWAFRules:Blockedrecon/fuzzUA\"][severity\"CRITICAL\"][hostname\"www.serverprivato.ch\"][uri\"/4host-di-roberto-santin/\"][unique_id\"agxBK0wFQH8i6PehyzbAIAAAAQ8\"]
show less
Hacking
Web App Attack
🇦🇺
RedBear IT
2026-03-26 10:00:37
(2 months ago)
"DDoS against public endpoint"
DDoS Attack
🇺🇸
TPI-Abuse
2025-12-02 15:26:04
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 10:25:56.244639 2025] [security2:error] [pid 30577:tid 30577] [client 216.26.252.56:23489] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mymuscles.com"] [uri "/.env"] [unique_id "aS8FBK3AKeJ0pHob92feCgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 11:29:08
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 06:29:03.942215 2025] [security2:error] [pid 23596:tid 23596] [client 216.26.252.56:16501] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wiainvestigation.com"] [uri "/.svn/wc.db"] [unique_id "aS7Nf4Jxssgqaq6rdfLEDgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 07:32:54
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 02:32:50.516896 2025] [security2:error] [pid 8154:tid 8163] [client 216.26.252.56:40097] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "desert-automotive.com"] [uri "/.svn/wc.db"] [unique_id "aS6WIk2NVzhhs6YFphT0oAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 07:29:23
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:29:18.090654 2025] [security2:error] [pid 28710:tid 28710] [client 216.26.252.56:21529] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.canaldumidi360.com"] [uri "/.git/HEAD"] [unique_id "aSVazpUg4SGqkhR35M01iwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 02:43:05
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.252.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:43:00.992181 2025] [security2:error] [pid 32303:tid 32303] [client 216.26.252.56:9505] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danged.com"] [uri "/.svn/wc.db"] [unique_id "aSUXtDB401aYaffVb5b-AgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2025-10-29 20:34:31
(7 months ago)
Brute-Force
Showing 1 to
9
of 9 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: