JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.165.37

209.50.165.37 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 31%: ?

31%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.165.37

Whois 209.50.165.37

IP Abuse Reports for 209.50.165.37:

This IP address has been reported a total of 32 times from 18 distinct sources. 209.50.165.37 was first reported on September 28th 2025, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TAY	2026-07-07 05:31:18 (17 hours ago)	209.50.165.37 - - [07/Jul/2026:13:30:32 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6320 "-" "Mozilla/5.0 ... show more 209.50.165.37 - - [07/Jul/2026:13:30:32 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6320 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:118.0) Gecko/20100101 Firefox/118.0" 209.50.165.37 - - [07/Jul/2026:13:30:39 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6320 "https://duckduckgo.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 209.50.165.37 - - [07/Jul/2026:13:31:18 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6320 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Brute-Force
🇲🇽 octageeks.com	2026-07-07 04:14:20 (19 hours ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇺🇸 lostswordfish.com	2026-07-05 19:56:03 (2 days ago)	Wordfence waf block on baystatereentrynetwork	Web App Attack
🇫🇷 ELYAZ	2026-07-04 16:16:57 (3 days ago)	(y4) Failed scan -byebye- from 209.50.165.37 (US/United States/-): (CF_ENABLE)	Hacking
Anonymous	2026-05-11 02:06:41 (1 month ago)	Multiple failed login attemps RDS-Web-Access-Server	Brute-Force Web App Attack
🇱🇻 garmtech.com	2026-05-08 00:39:28 (1 month ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 03-39.209.50.165.37.web-spamme ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 03-39.209.50.165.37.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇫🇷 Baking333	2026-05-06 03:07:10 (2 months ago)	[redacted] 209.50.165.37 - - [06/May/2026:04:07:04 +0100] "GET /[redacted] HTTP/1.1" 302 1518 0/1444 ... show more [redacted] 209.50.165.37 - - [06/May/2026:04:07:04 +0100] "GET /[redacted] HTTP/1.1" 302 1518 0/144467 "-" "curl/8.7.1" [redacted] 209.50.165.37 - - [06/May/2026:04:07:08 +0100] "GET /[redacted] HTTP/1.1" 302 1518 0/122002 "-" "curl/8.7.1" show less	Bad Web Bot Web App Attack
🇺🇸 mind5t0rm	2026-02-04 18:03:32 (5 months ago)	(XMLRPC) WP XMLPRC Attack 209.50.165.37 (US/United States/-): 3 in the last 3600 secs; Ports: ; Dir ... show more (XMLRPC) WP XMLPRC Attack 209.50.165.37 (US/United States/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: 209.50.165.37 - - [05/Feb/2026:01:03:30 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Wget/1.21.4" 209.50.165.37 - - [05/Feb/2026:01:03:31 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Wget/1.21.4" 209.50.165.37 - - [05/Feb/2026:01:03:31 +0700] "POST /xmlrpc.php HTTP/2.0" 403 154 "-" "Wget/1.21.4" show less	Port Scan
🇺🇸 TPI-Abuse	2025-12-11 03:56:48 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 22:56:42.223516 2025] [security2:error] [pid 14843:tid 14843] [client 209.50.165.37:9719] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "t9teaminnovations.com"] [uri "/.env"] [unique_id "aTpA-uzTlCkzT5HxxZ2_JwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-10 16:00:36 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 10 11:00:33.467676 2025] [security2:error] [pid 30769:tid 30769] [client 209.50.165.37:20107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bookofraphael.com"] [uri "/.git/HEAD"] [unique_id "aTmZIWiYVx0FYMSQHS-IBgAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-09 04:50:23 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 23:50:17.055212 2025] [security2:error] [pid 22278:tid 22278] [client 209.50.165.37:30319] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adampayments.com"] [uri "/.svn/wc.db"] [unique_id "aTeqidC6MgegpQdnZ6cqRQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-08 19:21:23 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.165.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 14:21:17.070818 2025] [security2:error] [pid 17138:tid 17138] [client 209.50.165.37:55849] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "handcraftedparquet.com"] [uri "/.svn/wc.db"] [unique_id "aTclLU687Bj4o7KKWiNc9AAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 technojoe99	2025-12-07 12:50:06 (7 months ago)	Exploit scan from 209.50.165.37. GET /.aws/credentials HTTP/1.1.	Web App Attack
🇺🇸 myagent.site	2025-12-06 17:12:12 (7 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇸🇪 SkyDancer	2025-12-05 09:37:01 (7 months ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show more Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.252

🇪🇨 186.42.10.132

🇧🇷 149.19.175.40

🇺🇸 66.132.186.159

🇺🇸 52.177.169.196

🇺🇸 20.163.33.23

🇩🇪 213.209.159.227

🇺🇸 147.185.132.55

🇧🇷 143.95.209.223

🇳🇱 92.63.197.5

🇫🇷 91.231.89.76

🇫🇷 91.231.89.73

🇩🇪 78.111.75.47

🇹🇼 60.199.224.2

🇰🇪 197.248.8.33

🇺🇸 172.172.170.199

🇦🇴 154.71.156.207

🇳🇱 85.11.167.11

🇬🇧 35.203.211.106

🇩🇪 8.211.39.83