JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.253.150

216.26.253.150 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 33%: ?

33%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.253.150

Whois 216.26.253.150

IP Abuse Reports for 216.26.253.150:

This IP address has been reported a total of 20 times from 13 distinct sources. 216.26.253.150 was first reported on November 6th 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 lp	2026-09-19 18:21:27 (1 hour ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 216.26.253.150 2026-09-19T19:57:26+02 ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 216.26.253.150 2026-09-19T19:57:26+02:00 vpn Access-Reject 'pbsuser' station: 216.26.253.150 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇮🇪 AutosOnShow	2026-09-17 21:24:06 (1 day ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-09-17 21:23:41.868 \|	Web App Attack
🇺🇸 lostswordfish.com	2026-09-11 21:16:03 (1 week ago)	Wordfence waf block on jestrellafoundation	Web App Attack
🇺🇸 drewf.ink	2026-09-04 02:21:46 (2 weeks ago)	[02:21] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [02:21] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇭🇰 Mehmet_The_Script_Kiddie	2026-08-14 18:40:06 (1 month ago)	AUTOMATED REPORT: Suspicous path traversal: /wp-json/oembed/1.0/embed?url=https://sophiatazar.com/	Bad Web Bot Web App Attack
🇫🇷 Sklurk	2026-08-05 01:58:11 (1 month ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-08-04 01:28:23 (1 month ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-07-31 00:21:28 (1 month ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-07-08 00:29:43 (2 months ago)	Web App Attack	Web App Attack
🇺🇸 mnsf	2026-06-04 19:07:31 (3 months ago)	Abuse Detected (4)	Brute-Force Web App Attack
🇺🇸 myagent.site	2026-01-20 21:43:10 (7 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
Anonymous	2026-01-20 19:30:11 (7 months ago)	Configuration snooping (/.env): 216.26.253.150 - - [20/Jan/2026:19:21:05 +0000] "GET /.env HTTP/1.1 ... show more Configuration snooping (/.env): 216.26.253.150 - - [20/Jan/2026:19:21:05 +0000] "GET /.env HTTP/1.1" 404 241 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safar" show less	Hacking Web App Attack
🇩🇪 ut-addicted.com	2025-12-30 07:37:37 (8 months ago)	\[Tue Dec 30 08:37:36.085524 2025\] \[:error\] \[pid 3966:tid 140546077062912\] \[client 216.26.253. ... show more \[Tue Dec 30 08:37:36.085524 2025\] \[:error\] \[pid 3966:tid 140546077062912\] \[client 216.26.253.150:35525\] \[client 216.26.253.150\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "www.ut-addicted.com"\] \[uri "/.git/HEAD"\] \[unique_id "aVOBQMoT2Qkw4kQrw56EjQAAAIg"\] show less	Brute-Force Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:00:52 (8 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-12-29 11:56:15 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.253.150 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.253.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 06:56:09.324062 2025] [security2:error] [pid 3236:tid 3236] [client 216.26.253.150:34579] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lancemarthaler.com"] [uri "/.svn/wc.db"] [unique_id "aVJsWWh2jixw8m3pwNUYwQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 218.94.16.158

🇨🇳 218.78.63.123

🇺🇸 216.146.3.9

🇫🇷 185.177.72.56

🇳🇱 161.35.155.10

🇮🇳 113.193.187.154

🇮🇳 103.171.55.242

🇳🇱 94.154.43.87

🇨🇳 14.103.117.88

🇩🇪 130.12.182.193

🇨🇳 118.248.199.91

🇧🇩 103.239.252.132

🇺🇸 66.132.172.116

🇳🇱 45.138.12.52

🇻🇳 14.231.18.221

🇨🇳 8.136.211.31

🇳🇱 195.178.110.218

🇮🇳 103.163.44.10

🇲🇦 41.143.33.121

🇻🇪 38.156.19.37