JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.254.20

216.26.254.20 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 34%: ?

34%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.254.20

Whois 216.26.254.20

IP Abuse Reports for 216.26.254.20:

This IP address has been reported a total of 20 times from 17 distinct sources. 216.26.254.20 was first reported on October 15th 2025, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 SX Communications	2026-09-02 05:09:18 (8 hours ago)	Blocked abusive HTTP application-layer DoS / botnet traffic from 216.26.254.20: traffic from this ad ... show more Blocked abusive HTTP application-layer DoS / botnet traffic from 216.26.254.20: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇺🇸 drewf.ink	2026-09-01 03:04:21 (1 day ago)	[03:04] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [03:04] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇬🇷 setupgr	2026-08-31 08:12:07 (2 days ago)	(wplogin_block) Blocked WP-Login Access Attempt 216.26.254.20 (FR/France/Ãle-de-France/Paris/-/[AS2 ... show more (wplogin_block) Blocked WP-Login Access Attempt 216.26.254.20 (FR/France/Ãle-de-France/Paris/-/[AS200373 DREI-K-TECH-GMBH]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 216.26.254.20 - - [31/Aug/2026:11:11:49 +0300] "POST /wp-login.php HTTP/1.1" 302 - "https://cpanagiotou.gr/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" show less	Port Scan
🇩🇪 conseilgouz	2026-08-31 07:28:41 (2 days ago)	sle-6 : Trying access system files=>/wp-login.php(wp-login.php)	Hacking
🇫🇷 Sklurk	2026-08-01 02:33:54 (1 month ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-07-31 00:28:04 (1 month ago)	Web App Attack	Web App Attack
🇲🇽 octageeks.com	2026-06-04 04:14:04 (2 months ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇺🇸 lostswordfish.com	2026-06-01 17:02:04 (3 months ago)	Wordfence waf block on hope4scranton	Web App Attack
🇲🇽 octageeks.com	2026-06-01 04:09:28 (3 months ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇩🇪 iNetWorker	2026-05-30 07:16:42 (3 months ago)	trolling for resource vulnerabilities	Web App Attack
Anonymous	2026-05-26 14:18:54 (3 months ago)	[server.tmg.gr] httpd-login-spray-site: sites=epemyjournal.com; logs=/var/log/httpd/domains/epemyjou ... show more [server.tmg.gr] httpd-login-spray-site: sites=epemyjournal.com; logs=/var/log/httpd/domains/epemyjournal.com.log; samples=site_wide=true \| distinct_ips=29 \| /wp-login.php show less	Hacking Web App Attack
🇵🇱 sefinek.net	2025-12-12 19:28:22 (8 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇭🇺 bcsaba	2025-12-06 22:09:52 (8 months ago)	Joomla spam 216.26.254.20 - - [06/Dec/2025:23:09:50 +0100] "GET /index.php?option=com_easyblog&view= ... show more Joomla spam 216.26.254.20 - - [06/Dec/2025:23:09:50 +0100] "GET /index.php?option=com_easyblog&view=dashboard&layout=write HTTP/1.1" 404 789 "https://REDACTED" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0" show less	Web App Attack
🇱🇹 Evag Touf	2025-11-26 15:05:30 (9 months ago)	(mod_security) mod_security triggered on hostname [redacted] 216.26.254.20 (FR/France/-)	SQL Injection
🇺🇸 TPI-Abuse	2025-11-24 09:27:31 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.254.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 216.26.254.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:27:25.604983 2025] [security2:error] [pid 3791441:tid 3791441] [client 216.26.254.20:51473] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.salsberggroup.com"] [uri "/.git/HEAD"] [unique_id "aSQk_SeQEOCxWiw-USj9ZwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:4:e8bb:8001

🇳🇱 2001:67c:e60:c0c:192:42:116:15

🇧🇷 170.78.4.29

🇫🇮 130.49.115.229

🇺🇸 74.82.47.37

🇺🇸 209.85.160.69

🇺🇸 172.202.118.8

🇺🇸 150.136.199.77

🇨🇳 106.119.165.171

🇳🇱 94.154.43.87

🇷🇺 87.250.224.223

🇩🇪 64.89.163.159

🇺🇸 2604:a880:400:d1:0:4:e8bb:d001

🇹🇼 192.72.56.178

🇨🇳 113.240.110.90

🇹🇼 110.25.107.172

🇺🇸 64.62.156.122

🇺🇸 45.79.145.34

🇺🇸 2604:a880:400:d1:0:4:e8db:2001

🇺🇸 195.184.76.161