JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.26.26

65.111.26.26 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 31%: ?

31%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.26.26

Whois 65.111.26.26

IP Abuse Reports for 65.111.26.26:

This IP address has been reported a total of 39 times from 21 distinct sources. 65.111.26.26 was first reported on June 27th 2024, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-07-23 04:08:05 (2 hours ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇫🇷 ELYAZ	2026-07-20 19:23:27 (2 days ago)	(wordpress) Failed wordpress login from 65.111.26.26 (ES/Spain/-): (CF_ENABLE)	Brute-Force
🇫🇷 tecnicorioja	2026-06-22 22:01:14 (1 month ago)	wp-login attack [22/Jun/2026:08:02:50	Brute-Force Web App Attack
🇫🇷 solution.it	2026-06-20 21:42:21 (1 month ago)	[Sat Jun 20 23:42:20.293354 2026] [php7:error] [pid 1327202:tid 1327202] [client 65.111.26.26:26369] ... show more [Sat Jun 20 23:42:20.293354 2026] [php7:error] [pid 1327202:tid 1327202] [client 65.111.26.26:26369] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat, referer: https://informationsecurity.solution.it/wp-login.php show less	Web App Attack
🇬🇷 setupgr	2026-06-19 22:58:04 (1 month ago)	(mod_security) mod_security (id:900001) triggered by 65.111.26.26 (ES/Spain/Madrid/Madrid/-/[AS20037 ... show more (mod_security) mod_security (id:900001) triggered by 65.111.26.26 (ES/Spain/Madrid/Madrid/-/[AS200373 DREI-K-TECH-GMBH]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Jun 20 01:58:03.578104 2026] [security2:error] [pid 2278:tid 2444] [client 65.111.26.26:22375] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|sea-sound\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "75"] [id "900001"] [msg "Blocked WP Login attempt on domain: adoro.gr"] [severity "CRITICAL"] [tag "security"] [hostname "adoro.gr"] [uri "/wp-login.php"] [unique_id "ajXJewuYeXI6iTUJgvs8BwAAAIs"], referer: https://adoro.gr/wp-login.php show less	Port Scan
🇫🇷 ELYAZ	2026-06-15 16:40:07 (1 month ago)	(y4) Failed scan -byebye- from 65.111.26.26 (ES/Spain/-): (CF_ENABLE)	Hacking
🇺🇸 mnsf	2026-06-15 00:12:25 (1 month ago)	Login Too Frequent (6)	Brute-Force Web App Attack
🇬🇧 poundawebsiteltd	2026-06-11 11:31:41 (1 month ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.26.26 - - [11/Jun/2026:12:31:39 +0100] PO ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.26.26 - - [11/Jun/2026:12:31:39 +0100] POST /wp-login.php HTTP/1.1 301 3455 https://[REDACTED_DOMAIN]/wp-login.php Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 show less	Web App Attack
🇬🇧 PeravixGroup	2026-05-07 06:21:35 (2 months ago)	Honeypot detection: Docker daemon unauthorized access / container escape attempt on port 2375. Sever ... show more Honeypot detection: Docker daemon unauthorized access / container escape attempt on port 2375. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇮🇹 [email protected]	2026-04-17 22:57:26 (3 months ago)	[Sat Apr 18 00:57:25.748861 2026] [authz_core:error] [pid 560721:tid 560754] [remote 65.111.26.26:34 ... show more [Sat Apr 18 00:57:25.748861 2026] [authz_core:error] [pid 560721:tid 560754] [remote 65.111.26.26:34449] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/wp-login.php ... show less	Brute-Force Web App Attack
🇳🇱 jjnxpct	2026-02-16 04:55:02 (5 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env.production (Rule ID: 930130) - Restricted File Access Attempt show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 12:28:53 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.26.26 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.26.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:28:49.987659 2026] [security2:error] [pid 30839:tid 30839] [client 65.111.26.26:53085] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sfpantry.com"] [uri "/site/.git/config"] [unique_id "aZG8Abz0OVixFl0T4dvYVAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 07:12:14 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.26.26 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.26.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 02:12:10.676678 2026] [security2:error] [pid 27766:tid 27766] [client 65.111.26.26:30025] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "secuencia.com"] [uri "/.env.production"] [unique_id "aZFxysv9gJ6xNWkbEF6tCgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 06:54:04 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.26.26 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.26.26 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 01:53:57.107336 2026] [security2:error] [pid 2303:tid 2303] [client 65.111.26.26:33999] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "orchestrateyouraptitudes.com"] [uri "/.env.save"] [unique_id "aZFthTn2IeF1mI3CvspCfQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-15 06:42:37 (5 months ago)	(mod_security) mod_security triggered on hostname [redacted] 65.111.26.26 (ES/Spain/-)	SQL Injection

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.126

🇺🇸 195.184.76.21

🇨🇳 175.6.109.238

🇸🇬 165.22.57.22

🇫🇮 147.185.133.69

🇺🇸 64.62.197.12

🇯🇵 43.165.185.177

🇧🇪 35.195.88.161

🇵🇰 223.123.11.136

🇵🇦 190.97.165.154

🇺🇸 170.39.184.167

🇰🇷 106.243.87.164

🇺🇸 93.152.208.42

🇯🇵 43.165.178.246

🇯🇵 43.165.170.198

🇰🇪 41.90.100.147

🇬🇧 2.57.17.240

🇮🇳 202.142.67.207

🇺🇸 191.101.33.225

🇷🇺 178.213.114.194