JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.255.112

216.26.255.112

Recent Activity

20 reports found in our database

29% ▲ ▲ ▲ Elevated

Abuse confidence score ?

ISP

3xK Tech GmbH

Usage Type

Data Center/Web Hosting/Transit

ASN

AS200373

Domain Name

3xktech.cloud

Country

🇩🇪 Germany

City

Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 216.26.255.112:

This IP address has been reported a total of 20 times from 12 distinct sources. 216.26.255.112 was first reported on October 6th 2025, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: France with 2 reports; United States of America with 2 reports; Australia with 1 report. Over the same time period, 216.26.255.112 has changed country of origin 2 times. The most common categories in these recent reports were: Web App Attack 6 times; Bad Web Bot 1 time; Brute-Force 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Ben Schoolland	2026-09-11 22:09:36 (1 day ago)	Unauthenticated POST to internal WordPress PHP file that is never an HTTP endpoint: POST /wp-content ... show more Unauthenticated POST to internal WordPress PHP file that is never an HTTP endpoint: POST /wp-content/plugins/seo-by-rank-math/includes/modules/analytics/views/dashboard.php -> 200 at 11/Sep/2026:11:12:50 UTC (beanythingmuseum.org). Single request from this IP; part of a coordinated scan from 216.26.224.0/19 (AS200373, 3xK Tech GmbH) in which 29 distinct IPs each sent exactly one POST within a 24-minute window (10:50-11:14 UTC 2026-09-11) to probe for pre-installed PHP backdoors (sibling IPs requested xmlrpctag.php, index.arr.php, log_header.inc.php, defines.php under plugin vendor/ directories). One-request-per-IP distribution is deliberate rate-limit evasion. show less	Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-08-25 04:09:54 (2 weeks ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇵🇱 ketovoila.pl	2026-08-24 15:02:02 (2 weeks ago)	ketovoila.pl WordPress login/xmlrpc probing: hits=1; unique_paths=1; sample_paths=/wp-login.php; UA= ... show more ketovoila.pl WordPress login/xmlrpc probing: hits=1; unique_paths=1; sample_paths=/wp-login.php; UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15"; window=2026-08-24T15:02:02Z..2026-08-24T15:02:02Z show less	Web App Attack
🇫🇷 ELYAZ	2026-08-23 21:23:50 (2 weeks ago)	(wordpress) Failed wordpress login from 216.26.255.112 (FR/France/-): (CF_ENABLE)	Brute-Force
🇺🇸 lostswordfish.com	2026-08-22 21:32:03 (3 weeks ago)	Wordfence waf block on flintlocal432	Web App Attack
🇦🇺 paulshipley.com.au	2026-08-22 01:35:05 (3 weeks ago)	angleseaarthouse.com.au:443 216.26.255.112 - - [22/Aug/2026:11:35:02 +1000] "GET /?author=1 HTTP/1.1 ... show more angleseaarthouse.com.au:443 216.26.255.112 - - [22/Aug/2026:11:35:02 +1000] "GET /?author=1 HTTP/1.1" 404 176630 "https://t.co/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" ... show less	Web App Attack
🇫🇷 Sklurk	2026-08-01 02:54:23 (1 month ago)	Web App Attack	Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (5 months ago)	"DDoS against public endpoint"	DDoS Attack
🇫🇷 dynamix	2026-01-14 06:52:00 (7 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 10:33:23 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 05:33:18.928443 2025] [security2:error] [pid 24878:tid 24878] [client 216.26.255.112:9003] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.aoklandco.com"] [uri "/.env"] [unique_id "aSbXbtHa_FJ_qcs7fltgVAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 06:06:55 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 01:06:52.003823 2025] [security2:error] [pid 28332:tid 28332] [client 216.26.255.112:15137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.virginiabeachlovebird.com"] [uri "/.env"] [unique_id "aSaY_ImnXzXvAt2O8zFVQQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 01:41:05 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:40:59.585447 2025] [security2:error] [pid 3365543:tid 3365666] [client 216.26.255.112:9301] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.e-dome.co.jp"] [uri "/.git/HEAD"] [unique_id "aSZaq2zJ-U6IElkF6xNOfgAAAdE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 01:11:54 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:11:49.921208 2025] [security2:error] [pid 10841:tid 10841] [client 216.26.255.112:34997] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.tylercomputing.com"] [uri "/.env"] [unique_id "aSZT1UTxAL8GIeK8PFr5BwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 00:10:30 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:10:26.484367 2025] [security2:error] [pid 20957:tid 20957] [client 216.26.255.112:46317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.zombifiedpictures.andrsn.com"] [uri "/.git/HEAD"] [unique_id "aSZFcvgv7SpJ_8o7pNnuWwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 09:28:53 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 216.26.255.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:28:46.792566 2025] [security2:error] [pid 26085:tid 26085] [client 216.26.255.112:58725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sifnosgreekcatering.com"] [uri "/.env"] [unique_id "aSQlTpJ_eObDL8KmypPpngAAABI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 190.18.200.79

🇺🇸 172.202.118.2

🇸🇦 144.24.209.174

🇱🇹 141.98.9.21

🇺🇸 52.173.67.116

🇬🇧 35.203.210.8

🇻🇳 14.227.0.50

🇺🇸 216.25.89.142

🇺🇸 172.169.250.24

🇬🇧 62.60.130.142

🇨🇦 51.79.86.230

🇺🇸 45.156.129.77

🇨🇳 220.174.29.212

🇧🇷 186.235.163.11

🇨🇳 175.30.48.211

🇺🇸 172.190.100.10

🇩🇪 167.94.146.44

🇺🇸 136.70.177.196

🇺🇸 136.67.150.124

🇷🇴 92.118.39.77