JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.165.199

209.50.165.199 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 18%: ?

18%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.165.199

Whois 209.50.165.199

IP Abuse Reports for 209.50.165.199:

This IP address has been reported a total of 29 times from 19 distinct sources. 209.50.165.199 was first reported on September 30th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-10-24 07:53:02 (2 days ago)	Web App Attack	Web App Attack
🇨🇭 4server	2026-09-12 23:38:02 (1 month ago)	[SunSep1301:37:55.6750132026][security2:error][pid1557990:tid1558145][client209.50.165.199:0]ModSecu ... show more [SunSep1301:37:55.6750132026][security2:error][pid1557990:tid1558145][client209.50.165.199:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"635\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"www.r102.ch\"][uri\"/wp-content/plugins/wp-automatic/readme.txt\"][unique_id\"aqXiU4dSOf9A8-UFV7U_jwAAAA8\"] show less	Hacking Web App Attack
🇺🇸 drewf.ink	2026-09-04 11:43:33 (1 month ago)	[11:43] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [11:43] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇺🇦 URAN Publishing Service	2026-08-30 16:04:16 (1 month ago)	[30/Aug/2026:19:04:15 +0300] -- 209.50.165.199 Ban reason: Scanner [CMS_GENERIC] \| Request: GET http ... show more [30/Aug/2026:19:04:15 +0300] -- 209.50.165.199 Ban reason: Scanner [CMS_GENERIC] \| Request: GET http://problemps.kpnu.edu.ua/wp-content/uploads/sites/58/2016/03/28-3.pdf HTTP/1.1 show less	Bad Web Bot Web App Attack
🇫🇷 Sklurk	2026-07-31 01:50:02 (2 months ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-07-30 00:13:33 (2 months ago)	Web App Attack	Web App Attack
Anonymous	2026-04-22 15:16:42 (6 months ago)	Attempt to scan vulnerabilities	Hacking
Anonymous	2026-04-12 06:05:38 (6 months ago)	Attempt to scan vulnerabilities	Hacking
Anonymous	2025-12-22 15:44:20 (10 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 21:11:08 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.165.199 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.165.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:11:02.592187 2025] [security2:error] [pid 21273:tid 21273] [client 209.50.165.199:39537] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drjasonkolber.com"] [uri "/.svn/wc.db"] [unique_id "aSi-ZgxgfmstbeRXA5-svgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 18:49:59 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.165.199 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.165.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 13:49:55.063726 2025] [security2:error] [pid 7229:tid 7229] [client 209.50.165.199:34689] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1800glass.com"] [uri "/.git/HEAD"] [unique_id "aSidUzt6ocJPwmO_8DY_KgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-26 22:15:02 (11 months ago)	suspicious request in access.log	Web App Attack
🇺🇸 mind5t0rm	2025-11-19 17:08:30 (11 months ago)	(WPLOGIN) WP Login Attack 209.50.165.199 (US/United States/-): 3 in the last 3600 secs; Ports: ; Di ... show more (WPLOGIN) WP Login Attack 209.50.165.199 (US/United States/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: 209.50.165.199 - - [20/Nov/2025:00:08:02 +0700] "GET /wp-login.php?wp_lang=en_US HTTP/2.0" 200 2917 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36" 209.50.165.199 - - [20/Nov/2025:00:08:06 +0700] "POST /wp-login.php?wp_lang=en_US HTTP/2.0" 302 0 "https://zerowaterthailand.com/wp-login.php?wp_lang=en_US" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36" 209.50.165.199 - - [20/Nov/2025:00:08:27 +0700] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.zerowaterthailand.com%2Fwp-admin%2Fplugins.php&reauth=1 HTTP/2.0" 200 2910 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36" show less	Port Scan
🇺🇸 fbarela	2025-11-19 06:00:30 (11 months ago)	FortiGate SSL VPN login failures.	Hacking Brute-Force
Anonymous	2025-11-13 23:34:40 (11 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 2a0f:ca80:b00b:1d9b::5

🇺🇸 209.139.45.148

🇳🇱 195.178.110.159

🇺🇸 170.106.194.247

🇺🇸 162.216.149.89

🇵🇰 124.29.214.78

🇺🇸 104.23.251.175

🇫🇷 91.231.89.76

🇫🇷 89.93.134.82

🇯🇵 34.146.48.116

🇭🇰 20.205.15.223

🇦🇺 13.54.83.96

🇻🇳 2405:4802:9435:2e0:fccf:c39b:9232:1fae

🇺🇸 216.25.89.68

🇺🇸 202.81.208.72

🇨🇴 190.27.25.234

🇲🇽 189.190.168.131

🇭🇰 188.253.126.196

🇧🇷 186.192.79.157

🇳🇱 185.196.220.132