JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.22.200

65.111.22.200 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 40%: ?

40%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.22.200

Whois 65.111.22.200

IP Abuse Reports for 65.111.22.200:

This IP address has been reported a total of 23 times from 18 distinct sources. 65.111.22.200 was first reported on September 26th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 drewf.ink	2026-09-01 10:25:07 (2 days ago)	[10:25] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [10:25] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇫🇷 tecnicorioja	2026-08-24 22:01:21 (1 week ago)	wp-login attack [24/Aug/2026:23:13:24	Brute-Force Web App Attack
🇩🇪 4server	2026-08-23 03:06:49 (1 week ago)	[SunAug2305:06:44.4244142026][security2:error][pid3295601:tid3295696][client65.111.22.200:0]ModSecur ... show more [SunAug2305:06:44.4244142026][security2:error][pid3295601:tid3295696][client65.111.22.200:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"beyondsecurity.ch\"][uri\"/xmlrpc.php\"][unique_id\"aopjxC48UY4cM7S5avFG0wAAAUk\"]\,referer:https://wordpress.org/ show less	Port Scan Brute-Force Web App Attack
🇮🇹 VHosting	2026-08-22 23:10:07 (1 week ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇦🇺 HJ5Ss4Ju	2026-08-21 19:10:34 (1 week ago)	Blocked by Wordfence (SID 6)	Web App Attack
Anonymous	2026-08-21 19:09:10 (1 week ago)	2026-08-21T21:09:09.695094+02:00 polaris wp(sahpa.co.za)[341294]: Authentication attempt for unknown ... show more 2026-08-21T21:09:09.695094+02:00 polaris wp(sahpa.co.za)[341294]: Authentication attempt for unknown user wpadminerlzp from 65.111.22.200 ... show less	Brute-Force Web App Attack
🇫🇷 Sklurk	2026-08-01 00:08:29 (1 month ago)	Web App Attack	Web App Attack
🇺🇸 etu brutus	2026-05-27 15:52:36 (3 months ago)	65.111.22.200 has been banned for [WebApp Attack] ...	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 20:10:04 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 15:09:58.099800 2025] [security2:error] [pid 3956:tid 3956] [client 65.111.22.200:36611] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wbcsnet.com"] [uri "/.svn/wc.db"] [unique_id "aS9HlmDn1H52bti35hyTjAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 14:57:53 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 09:57:46.732908 2025] [security2:error] [pid 28580:tid 28580] [client 65.111.22.200:26607] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rblep.com"] [uri "/.svn/wc.db"] [unique_id "aS7-asqy6laJNomQmD22VQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 11:41:38 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 06:41:32.018017 2025] [security2:error] [pid 17859:tid 17859] [client 65.111.22.200:57347] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fromsaintlouis.com"] [uri "/.svn/wc.db"] [unique_id "aS7QbP3ODSZm9qiKh-8t2gAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 06:00:28 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 65.111.22.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 01:00:15.049353 2025] [security2:error] [pid 469:tid 469] [client 65.111.22.200:43589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web-sitebuilder.com"] [uri "/.env"] [unique_id "aS6Ab6Uxto5BGh4ezXY-QAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 madeit	2025-11-30 04:35:35 (9 months ago)		Web App Attack
Anonymous	2025-10-30 13:58:21 (10 months ago)	WordPress Brute Force	Brute-Force
🇩🇪 Marc	2025-10-29 17:59:11 (10 months ago)		Brute-Force Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 202.51.199.2

🇨🇱 200.104.61.214

🇺🇸 192.81.211.161

🇹🇷 176.53.22.183

🇭🇰 156.225.1.106

🇨🇳 124.89.90.52

🇫🇷 77.239.124.214

🇹🇼 36.230.97.56

🇺🇸 2.27.160.87

🇰🇷 211.240.117.71

🇺🇸 185.251.19.198

🇩🇿 154.241.53.244

🇺🇸 150.107.38.213

🇨🇳 124.89.90.54

🇺🇸 104.154.200.154

🇸🇬 104.28.222.46

🇱🇹 77.90.185.20

🇺🇸 24.198.79.60

🇧🇷 205.210.31.232

🇧🇪 198.235.24.221