JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.164.96

209.50.164.96 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 15%: ?

15%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.164.96

Whois 209.50.164.96

IP Abuse Reports for 209.50.164.96:

This IP address has been reported a total of 31 times from 17 distinct sources. 209.50.164.96 was first reported on September 26th 2025, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-28 17:53:28 (11 hours ago)	[TueJul2819:53:23.9148942026][security2:error][pid1899196:tid1899536][client209.50.164.96:0]ModSecur ... show more [TueJul2819:53:23.9148942026][security2:error][pid1899196:tid1899536][client209.50.164.96:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"giuristifriburgo.ch\"][uri\"/wp-login.php\"][unique_id\"amjsk_cHgmuwVv1aP7XU2gAAAQ8\"]\,referer:https://giuristifriburgo.ch/wp-login.php show less	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-06-07 20:00:52 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇧🇪 cmbplf	2026-06-02 02:33:52 (1 month ago)	1.306 POST requests with url.path */wp-login.php	Brute-Force Bad Web Bot
🇩🇪 london2038.com	2026-04-19 02:15:33 (3 months ago)	Detected by WP fail2ban 2026-04-19T04:15:33.414493+02:00 wordpress: Authentication attempt from 209. ... show more Detected by WP fail2ban 2026-04-19T04:15:33.414493+02:00 wordpress: Authentication attempt from 209.50.164.96 show less	Brute-Force Web App Attack
🇫🇮 as211431.net	2026-03-17 12:07:04 (4 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇮 000rosiu	2026-02-11 17:07:12 (5 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 200373 (DREI-K-TECH-GMBH ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 200373 (DREI-K-TECH-GMBH) Protocol: HTTP/1.1 (GET method) Endpoint: /app/.env Timestamp: 2026-02-11T17:03:11Z Ray ID: 9cc56b0e692ff791 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Report generated by Cloudflare-WAF-To-AbuseIPDB: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-10 03:17:38 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 22:17:32.438380 2026] [security2:error] [pid 23257:tid 23270] [client 209.50.164.96:41733] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iamalibrarian.com"] [uri "/config/.env"] [unique_id "aYqjTHufXfAJQmS5a-_STQAAAUk"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2026-02-10 03:03:40 (5 months ago)	2026-02-10 04:03:40 (CET) ~ Blocked by abusescan risk assessment	Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 02:53:09 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:53:04.780494 2026] [security2:error] [pid 27074:tid 27074] [client 209.50.164.96:52535] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kingdom-way.org"] [uri "/admin/.git/config"] [unique_id "aYqdkLsWoo1vs42XjEIKVQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 23:11:51 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 18:11:13.261021 2026] [security2:error] [pid 28771:tid 28771] [client 209.50.164.96:52991] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hppagewideprinting.com"] [uri "/frontend/.env"] [unique_id "aYppkT7iYWgdeI1bUimC_gAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 22:03:58 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:03:52.092191 2026] [security2:error] [pid 2504:tid 2504] [client 209.50.164.96:31785] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kathleenullmann.com"] [uri "/dev/.git/config"] [unique_id "aYpZyEd4Xp2aQwBtpPPgnQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 SSH-Admin	2026-02-07 17:12:28 (5 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-01-17 06:04:50 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 01:04:44.978760 2026] [security2:error] [pid 12105:tid 12105] [client 209.50.164.96:12257] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.grdigitaldesigns.com"] [uri "/.env"] [unique_id "aWsmfFABADsibRGPA46QfgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-17 04:01:51 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.164.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 23:01:49.093805 2026] [security2:error] [pid 28613:tid 28613] [client 209.50.164.96:44203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.facbook-marketplce.justiart.com"] [uri "/.env"] [unique_id "aWsJrad75gnSMfZ1ydsKDgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:11 (6 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 219.78.63.235

🇨🇱 179.57.170.71

🇺🇸 152.163.162.195

🇺🇸 152.163.162.61

🇺🇸 152.163.16.155

🇺🇸 152.163.16.101

🇺🇸 147.185.132.136

🇺🇸 147.185.132.28

🇺🇸 103.143.231.24

🇮🇩 103.98.176.164

🇮🇹 95.228.172.173

🇺🇸 64.185.224.130

🇧🇷 45.177.210.193

🇧🇾 37.212.49.80

🇬🇧 37.10.113.222

🇮🇩 36.94.242.213

🇮🇩 36.94.141.149

🇺🇸 20.38.42.22

🇺🇿 213.230.87.10

🇧🇷 205.210.31.144