JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.26.1

65.111.26.1 was found in our database!

This IP was reported 65 times. Confidence of Abuse is 33%: ?

33%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.26.1

Whois 65.111.26.1

IP Abuse Reports for 65.111.26.1:

This IP address has been reported a total of 65 times from 24 distinct sources. 65.111.26.1 was first reported on July 3rd 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 poundawebsiteltd	2026-06-22 18:32:51 (1 day ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.26.1 - - [22/Jun/2026:19:32:45 +0100] POS ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.26.1 - - [22/Jun/2026:19:32:45 +0100] POST /wp-login.php HTTP/1.1 200 10078 https://[REDACTED_DOMAIN]/wp-login.php Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 show less	Web App Attack
🇲🇹 Malta	2026-06-15 15:28:02 (1 week ago)	65.111.26.1 - - [15/Jun/2026:17:28:02 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu ... show more 65.111.26.1 - - [15/Jun/2026:17:28:02 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇩🇪 Tha_14	2026-06-12 12:46:40 (1 week ago)	Attempt to log in with non-existing username: administrator	Bad Web Bot
🇬🇧 poundawebsiteltd	2026-06-11 20:13:40 (1 week ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.26.1 - - [11/Jun/2026:21:13:36 +0100] POS ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.26.1 - - [11/Jun/2026:21:13:36 +0100] POST /wp-login.php HTTP/1.1 200 7362 https://[REDACTED_DOMAIN]/wp-login.php Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 show less	Web App Attack
🇦🇺 oncord	2026-05-24 15:02:16 (4 weeks ago)	Form spam	Web Spam
🇱🇻 garmtech.com	2026-05-18 01:49:20 (1 month ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 04-49.65.111.26.1.web-spammers ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 04-49.65.111.26.1.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇬🇧 Smish	2026-04-30 13:14:53 (1 month ago)	HONEYPOT HIT --> Fail2ban time=1777554892 log=2026-04-30T14:14:52+01:00 ip=65.111.26.1 host=router.h ... show more HONEYPOT HIT --> Fail2ban time=1777554892 log=2026-04-30T14:14:52+01:00 ip=65.111.26.1 host=router.ham.as210667.net method=GET uri="/.env" status=404 ua="Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.0.3) Gecko/2008092414 Firefox/3.0.3" ref="-" rid=130c1de2e44b814994e5699aab406ce4 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-04-29 20:53:34 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 65.111.26.1 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 65.111.26.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 16:53:28.761740 2026] [security2:error] [pid 1240:tid 1240] [client 65.111.26.1:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|aslanhan.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aslanhan.com"] [uri "/s3cmd.ini"] [unique_id "afJvyMfOuYV7MMgRkkZYiAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-04-28 20:19:04 (1 month ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 65.111.26.1 (ES/Spain/-): 1 in the la ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 65.111.26.1 (ES/Spain/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 oncord	2026-04-23 08:54:02 (2 months ago)	Form spam	Web Spam
🇦🇺 oncord	2026-04-20 03:24:10 (2 months ago)	Form spam	Web Spam
Anonymous	2026-04-17 22:21:16 (2 months ago)	Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10. ... show more Automated bot traffic — residential proxy, fake browser fingerprint. UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 OPR/128.0.0.0" show less	Bad Web Bot Web App Attack
🇦🇺 oncord	2026-04-09 02:27:16 (2 months ago)	Form spam	Web Spam
🇺🇸 oncord	2026-02-24 00:17:29 (4 months ago)	Form spam	Web Spam
🇺🇸 oncord	2026-02-21 02:01:34 (4 months ago)	Form spam	Web Spam

Showing 1 to 15 of 65 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.35.39.148

🇺🇸 185.61.220.72

🇺🇸 162.216.150.150

🇫🇷 83.171.226.124

🇬🇧 35.203.210.160

🇷🇺 31.173.81.194

🇮🇳 2404:6800:4000:1001::12b

🇰🇷 211.223.107.86

🇧🇪 198.235.24.216

🇧🇪 198.235.24.145

🇳🇱 195.178.110.188

🇺🇸 91.230.168.176

🇺🇸 66.132.186.139

🇱🇹 62.60.130.219

🇨🇳 39.89.161.184

🇩🇪 35.207.151.200

🇨🇳 14.29.184.206

🇺🇸 3.130.168.2

🇬🇧 2a06:4880:4000::52

🇮🇷 193.151.133.105