JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.172.52

209.50.172.52 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 23%: ?

23%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.172.52

Whois 209.50.172.52

IP Abuse Reports for 209.50.172.52:

This IP address has been reported a total of 25 times from 12 distinct sources. 209.50.172.52 was first reported on September 26th 2025, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mnsf	2026-06-09 13:07:16 (4 days ago)	Scanning/Probing (34)	Brute-Force Web App Attack
🇬🇧 PeravixGroup	2026-05-22 13:20:49 (3 weeks ago)	Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: ME ... show more Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇪🇸 librebit	2026-05-17 04:28:59 (3 weeks ago)	Brute force	Brute-Force
🇪🇸 librebit	2026-05-13 23:10:45 (4 weeks ago)	Brute force	Brute-Force
🇨🇳 ThreatBook.io	2026-04-25 23:12:50 (1 month ago)	ThreatBook Intelligence: http_proxy,Scanner more details on https://threatbook.io/ip/209.50.172.52 2 ... show more ThreatBook Intelligence: http_proxy,Scanner more details on https://threatbook.io/ip/209.50.172.52 2026-04-25 03:57:24 /druid/index.html show less	Web App Attack
🇩🇪 Ad Ministrator	2026-04-23 22:37:02 (1 month ago)	RdpGuard detected brute-force attempt on RD-WEB	Brute-Force
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇺🇸 TPI-Abuse	2026-01-21 10:54:13 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 209.50.172.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 209.50.172.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 21 05:54:06.958730 2026] [security2:error] [pid 3677:tid 3677] [client 209.50.172.52:52035] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|primacomm.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXCwTkgZctpIX0hpHa0HIAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-01-12 23:47:31 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/209.50.172.52 20 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/209.50.172.52 2026-01-12 05:37:00 /news/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2026-01-04 23:12:03 (5 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/209.50.172.52 2026-01- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/209.50.172.52 2026-01-04 18:39:13 /%23/serviceSync show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-24 23:27:19 (5 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/209.50.172.52 2025-12- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/209.50.172.52 2025-12-24 20:03:23 /nacos/%23/serviceSync 2025-12-24 19:50:54 /fang/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-15 23:49:04 (5 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/209.50.172.52 2025-12- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/209.50.172.52 2025-12-15 18:03:39 /photo/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) 2025-12-15 17:41:36 /fang/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇺🇸 myagent.site	2025-12-08 04:07:06 (6 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇺🇸 TPI-Abuse	2025-12-07 23:18:56 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.172.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.172.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 18:18:53.376729 2025] [security2:error] [pid 4036:tid 4036] [client 209.50.172.52:58543] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "corepest.com"] [uri "/.git/HEAD"] [unique_id "aTYLXU6iQ0ao9M66actwMgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-06 19:46:39 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.172.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 209.50.172.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 14:46:31.741424 2025] [security2:error] [pid 25360:tid 25360] [client 209.50.172.52:48497] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "servecon.net"] [uri "/.git/HEAD"] [unique_id "aTSIFwheGs-73b_dR2P0AgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 173.239.240.131

🇻🇳 45.119.212.99

🇺🇸 40.76.139.157

🇺🇸 37.140.223.240

🇻🇳 27.79.40.244

🇨🇳 211.149.131.113

🇩🇪 139.19.117.130

🇰🇷 133.186.229.52

🇮🇳 122.168.123.73

🇸🇪 104.23.223.126

🇰🇪 102.211.145.93

🇨🇳 101.72.105.238

🇺🇸 74.249.144.130

🇺🇸 68.235.61.155

🇸🇬 47.84.110.61

🇨🇦 15.235.123.247

🇰🇷 222.122.98.135

🇨🇳 222.92.61.242

🇰🇭 175.100.107.238

🇺🇸 107.174.136.123