JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 193.56.28.72

193.56.28.72 was found in our database!

This IP was reported 65 times. Confidence of Abuse is 12%: ?

12%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 193.56.28.72

Whois 193.56.28.72

IP Abuse Reports for 193.56.28.72:

This IP address has been reported a total of 65 times from 26 distinct sources. 193.56.28.72 was first reported on December 2nd 2020, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 maxasp.net	2026-09-18 04:24:05 (9 hours ago)	Invalid var_id in cart/add; Attack Var: var_id2; Attack Data: 388315-1) OR 538=(SELECT 538 FROM PG_S ... show more Invalid var_id in cart/add; Attack Var: var_id2; Attack Data: 388315-1) OR 538=(SELECT 538 FROM PG_SLEEP(15))-- show less	Hacking
🇺🇸 drewf.ink	2026-09-04 07:04:34 (2 weeks ago)	[07:04] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [07:04] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇩🇪 4server	2026-05-13 19:07:32 (4 months ago)	[WedMay1321:07:27.4168222026][security2:error][pid2127246:tid2127305][client193.56.28.72:0]ModSecuri ... show more [WedMay1321:07:27.4168222026][security2:error][pid2127246:tid2127305][client193.56.28.72:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"vulcanoricambi.ch\"][uri\"/.aws/credentials\"][unique_id\"agTL7_EFW5PgeCtX9hHkzQAAAFI\"] show less	Port Scan Brute-Force Web App Attack
🇸🇬 ipidentify	2026-05-12 19:38:16 (4 months ago)	2026-05-12T19:38:16Z GET /.env	Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 16:37:26 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 12:37:20.403006 2026] [security2:error] [pid 6040:tid 6040] [client 193.56.28.72:12591] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danieljensen.org"] [uri "/.env"] [unique_id "agNXQJqrbGeMKzNswEQoVQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-05-12 14:39:54 (4 months ago)	[TueMay1216:39:50.3952722026][security2:error][pid161282:tid161394][client193.56.28.72:0]ModSecurity ... show more [TueMay1216:39:50.3952722026][security2:error][pid161282:tid161394][client193.56.28.72:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".db\"][severity\"ERROR\"][hostname\"casacarmen.ch\"][uri\"/.svn/wc.db\"][unique_id\"agM7tht5FZVf3x9JQ88-zwAAAQQ\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-05-02 16:22:55 (4 months ago)	Forum/form spam	Web Spam
🇦🇺 oncord	2026-04-08 23:00:55 (5 months ago)	Form spam	Web Spam
🇳🇱 jjnxpct	2026-03-20 04:52:19 (5 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /fr/contact (Rule ID: 932230) - Remote Command Execution: Unix Command Injection (2-3 chars) show less	Web App Attack SQL Injection
🇦🇺 oncord	2026-03-19 22:46:16 (5 months ago)	Form spam	Web Spam
🇦🇺 oncord	2026-02-14 14:27:09 (7 months ago)	Form spam	Web Spam
🇺🇸 oncord	2026-02-13 12:35:41 (7 months ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-02-09 21:18:17 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 16:18:10.717128 2026] [security2:error] [pid 21439:tid 21439] [client 193.56.28.72:59351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "garagemensministry.org"] [uri "/backup/.git/config"] [unique_id "aYpPElpg_3tSkqCj8HDnsgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 17:58:19 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 12:58:16.169734 2026] [security2:error] [pid 24788:tid 24788] [client 193.56.28.72:56261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "furbabieslivesmatter.com"] [uri "/app/.env"] [unique_id "aYogOCXVHf8_zFFvcDGvsAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 12:01:58 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 193.56.28.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 07:01:51.590119 2026] [security2:error] [pid 11798:tid 11798] [client 193.56.28.72:60225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "galysh.us"] [uri "/new/.git/config"] [unique_id "aYnMr-JK2jhnihfi7o9gbwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 65 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.162

🇷🇴 193.32.162.156

🇲🇾 180.72.231.99

🇺🇸 173.239.240.70

🇺🇸 172.105.128.13

🇭🇰 156.225.1.10

🇨🇦 148.113.130.26

🇧🇪 91.179.63.239

🇱🇹 62.60.130.242

🇺🇸 45.8.19.51

🇧🇪 34.52.133.111

🇧🇷 179.48.18.42

🇸🇪 171.25.158.50

🇺🇸 162.216.150.180

🇫🇮 147.185.133.219

🇧🇬 109.160.32.30

🇫🇷 91.196.152.212

🇧🇬 79.124.62.126

🇿🇦 41.123.49.195

🇬🇧 35.203.211.46