JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 195.63.25.211

195.63.25.211 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 28%: ?

28%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 195.63.25.211

Whois 195.63.25.211

IP Abuse Reports for 195.63.25.211:

This IP address has been reported a total of 15 times from 9 distinct sources. 195.63.25.211 was first reported on May 23rd 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-10-18 13:22:53 (1 week ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 195.63.25.211 (GB/United Kingdom/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 195.63.25.211 (GB/United Kingdom/-): 1 in the last 3600 secs (0-196) show less	Hacking
🇮🇪 AutosOnShow	2026-10-17 09:51:17 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-17 09:50:46.814 \|	Web App Attack
🇺🇸 ne1for23	2026-10-16 08:12:02 (1 week ago)	Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" ... show more Attempt to access invalid virtual host name (###.###.###.###). Typically used to access "internal" resources improperly exposed externally and "protected" only by a lack of external DNS resolution. 195.63.25.211 - - [16/Oct/2026:08:12:01 +0000] "GET /.env HTTP/1.1" 403 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" "-" show less	Hacking
🇮🇪 AutosOnShow	2026-10-16 05:05:17 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-16 05:04:29.900 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-14 21:30:12 (1 week ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-14 21:29:40.279 \|	Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 16:31:44 (1 week ago)	(mod_security) mod_security (id:210350) triggered by 195.63.25.211 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 195.63.25.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 12:31:40.154692 2026] [security2:error] [pid 5836:tid 5836] [client 195.63.25.211:39152] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.directcch.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.directcch.com"] [uri "/wp-login.php"] [unique_id "as5c7PgWv-m6CAq00DeHeQAAABE"], referer: https://directcch.com/wp-login.php show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 AutosOnShow	2026-10-11 23:36:06 (2 weeks ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-11 23:35:38.494 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-11 10:57:05 (2 weeks ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-11 10:56:05.996 \|	Web App Attack
🇮🇪 AutosOnShow	2026-10-09 18:14:05 (2 weeks ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-10-09 18:13:45.336 \|	Web App Attack
🇫🇮 payincog	2026-09-03 19:00:21 (1 month ago)	Date: Sep 03 21:39:37 2026 EAT \| Reported IP: 195.63.25.211 mod_security \| id: 920350 \| DE/pay.my_do ... show more Date: Sep 03 21:39:37 2026 EAT \| Reported IP: 195.63.25.211 mod_security \| id: 920350 \| DE/pay.my_domain/- \| Connections: 1 \| Blocked: Permanent Block: [LF_MODSEC] \| Logs: ; Host header is a numeric IP address show less	SQL Injection Brute-Force Bad Web Bot
🇮🇹 CoreTech srl	2026-08-25 19:23:56 (2 months ago)	cloudlinux2 fail2ban: 2026-08-25 21:19:16,127 fail2ban.filter [1464]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-25 21:19:16,127 fail2ban.filter [1464]: INFO [plesk-modsecurity] Found 16.192.171.148 - 2026-08-25 21:19:15cloudlinux2 fail2ban: 2026-08-25 21:21:22,226 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 95.242.65.138 - 2026-08-25 21:21:22cloudlinux2 fail2ban: 2026-08-25 21:21:48,923 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 195.63.17.71 - 2026-08-25 21:21:48cloudlinux2 fail2ban: 2026-08-25 21:21:46,303 fail2ban.filter [1464]: INFO [plesk-modsecurity] Found 217.181.94.33 - 2026-08-25 21:21:46cloudlinux2 fail2ban: 2026-08-25 21:21:47,494 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 217.181.69.200 - 2026-08-25 21:21:47cloudlinux2 fail2ban: 2026-08-25 21:21:51,206 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 217.181.64.221 - 2026-08-25 21:21:50cloudlinux2 fail2ban: 2026-08-25 21:21:49,861 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 195.63.25.211 - 2026-08-25 21:21:49clo show less	Web App Attack
🇮🇹 CoreTech srl	2026-08-24 22:13:57 (2 months ago)	cloudlinux2 fail2ban: 2026-08-25 00:08:58,100 fail2ban.actions [1464]: NOTICE [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-25 00:08:58,100 fail2ban.actions [1464]: NOTICE [plesk-modsecurity] Unban 103.65.27.180cloudlinux2 fail2ban: 2026-08-25 00:09:34,722 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 217.181.85.25 - 2026-08-25 00:09:34cloudlinux2 fail2ban: 2026-08-25 00:09:34,183 fail2ban.filter [1464]: INFO [plesk-modsecurity] Found 195.63.22.191 - 2026-08-25 00:09:34cloudlinux2 fail2ban: 2026-08-25 00:09:35,424 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 195.63.24.29 - 2026-08-25 00:09:35cloudlinux2 fail2ban: 2026-08-25 00:09:37,409 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 195.63.10.38 - 2026-08-25 00:09:37cloudlinux2 fail2ban: 2026-08-25 00:09:36,104 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 195.63.23.33 - 2026-08-25 00:09:35cloudlinux2 fail2ban: 2026-08-25 00:09:38,132 fail2ban.filter [1464]: INFO [plesk-wordpress] Found 195.63.25.211 - 2026-08-25 00:09:37cloudlinux2 fail2ban: 2026-08- show less	Web App Attack
🇩🇪 FeG Deutschland	2026-08-24 22:02:49 (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇺🇸 SX Communications	2026-07-31 23:24:25 (2 months ago)	HTTP application-layer DoS / botnet traffic from 195.63.25.211: repeated high-cost dynamic page and ... show more HTTP application-layer DoS / botnet traffic from 195.63.25.211: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇨🇭 backslash	2026-05-23 15:21:00 (5 months ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 162.158.195.190

🇮🇳 98.70.48.241

🇳🇱 77.91.71.24

🇨🇦 70.54.182.130

🇺🇸 66.179.190.202

🇺🇸 50.6.197.187

🇷🇺 46.8.246.27

🇨🇳 220.181.108.175

🇰🇷 210.183.21.53

🇳🇱 185.224.128.16

🇨🇳 182.149.104.197

🇨🇦 152.236.14.113

🇳🇱 86.38.187.246

🇺🇸 50.6.249.168

🇺🇸 50.6.224.14

🇺🇸 216.180.246.243

🇬🇧 209.97.182.173

🇹🇼 198.235.24.126

🇨🇳 180.76.232.26

🇳🇱 159.223.223.91