JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

216.26.253.241

Activity Trending Down

Abuse Confidence Score

19% Caution

37 reports

23 reporters · latest 3 weeks ago

ISP: 3xK Tech GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS200373
Domain Name: 3xktech.cloud
Country: 🇩🇪 Germany
City: Berlin, State of Berlin

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

37 from 23 distinct reporters

First reported

September 30th 2025

Most recent report

3 weeks ago

Last 60 days

Top reporter locations 🇩🇪 Germany 3 🇪🇸 Spain 1 🇺🇸 United States of America 1

Most common categories Web App Attack 2 Hacking 2 Brute-Force 2 Fraud VoIP 1 Bad Web Bot 1

Old reports The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Ben Schoolland	2026-10-21 22:14:50 UTC · (3 weeks ago)	Coordinated distributed XML-RPC attack on chalkwild.com (WordPress). 21/Oct/2026:04:57:50 UTC: POST /xmlrpc.php, 1 request(s) from this IP. One of 234 POSTs to /xmlrpc.php from 209 distinct IPs inside a 4-minute window (04:55-04:59 UTC), 1-2 requests ... show more Coordinated distributed XML-RPC attack on chalkwild.com (WordPress). 21/Oct/2026:04:57:50 UTC: POST /xmlrpc.php, 1 request(s) from this IP. One of 234 POSTs to /xmlrpc.php from 209 distinct IPs inside a 4-minute window (04:55-04:59 UTC), 1-2 requests per IP - paced below per-IP rate limits, so only the 2 IPs exceeding 10 requests were caught by rate-based blocking. 97% of participating IPs sit in six allocations of one provider: 45.3.32.0/19, 65.111.0.0/19, 104.207.32.0/19, 209.50.160.0/19, 216.26.224.0/19, 217.181.64.0/19. Requests carry forged Referer headers (google.com/search?q=wordpress, facebook.com, duckduckgo.com) and randomised desktop browser User-Agents - XML-RPC is a machine API that browsers never call, so both are fabricated. UA sent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/11. The same address space has run a sustained web-shell discovery campaign against our servers since 2026-07-13. show less	Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-10-18 08:36:52 UTC · (3 weeks ago)	Detected by WP fail2ban 2026-10-18T10:36:51.639781+02:00 wordpress: XML-RPC authentication attempt from 216.26.253.241	Brute-Force Web App Attack
🇩🇪 netclix.gr	2026-10-09 06:28:49 UTC · (1 month ago)	(old_win_chrome) Blocked old Windows Chrome 216.26.253.241 (FR/France/-): (CF_ENABLE)	Hacking
🇪🇸 raiolanetworks.com	2026-09-21 04:40:49 UTC · (1 month ago)	Honeypot detection: Cisco ASA exploit attempt. 2 events observed. Reported automatically from a honeypot sensor.	Hacking
🇩🇪 paneologist	2026-09-15 08:17:23 UTC · (1 month ago)	2026-09-08T12:27:16+02:00 theta asterisk\[17133\]: NOTICE\[5761\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:34534\' \(callid: [email protected]. ... show more 2026-09-08T12:27:16+02:00 theta asterisk\[17133\]: NOTICE\[5761\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:34534\' \(callid: [email protected]\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[17469\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:9681\' \(callid: 22f3d32a294f63592baa2b600a9d4112\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[24074\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:9681\' \(callid: 22f3d32a294f63592baa2b600a9d4112\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[24074\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected] show less	Fraud VoIP Brute-Force
🇩🇪 paneologist	2026-09-13 19:51:00 UTC · (1 month ago)	2026-09-08T12:27:16+02:00 theta asterisk\[17133\]: NOTICE\[5761\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:34534\' \(callid: [email protected]. ... show more 2026-09-08T12:27:16+02:00 theta asterisk\[17133\]: NOTICE\[5761\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:34534\' \(callid: [email protected]\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[17469\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:9681\' \(callid: 22f3d32a294f63592baa2b600a9d4112\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[24074\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:9681\' \(callid: 22f3d32a294f63592baa2b600a9d4112\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[24074\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected] show less	Fraud VoIP Brute-Force
🇩🇪 paneologist	2026-09-08 18:34:06 UTC · (2 months ago)	2026-09-08T12:27:16+02:00 theta asterisk\[17133\]: NOTICE\[5761\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:34534\' \(callid: [email protected]. ... show more 2026-09-08T12:27:16+02:00 theta asterisk\[17133\]: NOTICE\[5761\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:34534\' \(callid: [email protected]\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[17469\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:9681\' \(callid: 22f3d32a294f63592baa2b600a9d4112\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[24074\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected]\>\' failed for \'216.26.253.241:9681\' \(callid: 22f3d32a294f63592baa2b600a9d4112\) - Not match Endpoint ACL 2026-09-08T17:13:14+02:00 theta asterisk\[17133\]: NOTICE\[24074\]: res_pjsip/pjsip_distributor.c:676 in log_failed_request: Request \'REGISTER\' from \'\<sip:[email protected] show less	Fraud VoIP Brute-Force
🇸🇪 OnTheEdge	2026-09-03 12:28:23 UTC · (2 months ago)	Password spraying. Multiple unauthorized login attempts	Hacking Web App Attack
🇸🇪 OnTheEdge	2026-09-02 17:23:15 UTC · (2 months ago)	Password spraying. Multiple unauthorized login attempts	Hacking Web App Attack
🇫🇷 Sklurk	2026-08-03 03:17:18 UTC · (3 months ago)	Web App Attack	Web App Attack
Anonymous	2026-08-03 01:39:52 UTC · (3 months ago)	IM360 WAF: Block request to XMLRPC with suspicious referer	Web App Attack
🇲🇽 octageeks.com	2026-08-02 04:16:17 UTC · (3 months ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇲🇽 octageeks.com	2026-07-31 04:12:11 UTC · (3 months ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇲🇹 Malta	2026-07-29 23:02:08 UTC · (3 months ago)	216.26.253.241 - - [30/Jul/2026:01:02:08 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15"	Hacking Web App Attack
🇫🇮 inlink.ltd	2026-06-06 10:38:45 UTC · (5 months ago)	dot file probe	Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 185.242.226.74

🇺🇸 185.89.110.186

🇳🇱 77.67.26.35

🇺🇸 206.232.2.50

🇺🇸 204.217.131.182

🇧🇷 200.223.25.122

🇧🇷 191.242.51.179

🇺🇸 191.102.132.120

🇺🇸 170.231.250.231

🇮🇩 153.60.139.120

🇦🇪 94.205.237.212

🇳🇱 86.38.187.251

🇺🇸 31.204.28.249

🇺🇸 2604:a880:400:d1:0:4:dee1:5001

🇰🇪 197.248.238.153

🇺🇾 179.25.231.59

🇪🇨 177.53.214.136

🇩🇪 139.59.129.37

🇨🇳 120.198.23.233

🇲🇦 105.159.252.61