JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.185.104

209.50.185.104 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 47%: ?

47%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.185.104

Whois 209.50.185.104

IP Abuse Reports for 209.50.185.104:

This IP address has been reported a total of 14 times from 11 distinct sources. 209.50.185.104 was first reported on November 2nd 2025, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 poundawebsiteltd	2026-06-11 13:31:05 (17 hours ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 209.50.185.104 - - [11/Jun/2026:14:30:59 +0100] ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 209.50.185.104 - - [11/Jun/2026:14:30:59 +0100] POST /xmlrpc.php HTTP/1.1 200 4115 - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 show less	Web App Attack
🇬🇷 setupgr	2026-06-11 08:43:53 (22 hours ago)	(mod_security) mod_security (id:900001) triggered by 209.50.185.104: 1 in the last 86400 secs; Ports ... show more (mod_security) mod_security (id:900001) triggered by 209.50.185.104: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Jun 11 11:43:51.626275 2026] [security2:error] [pid 2066466:tid 2066611] [client 209.50.185.104:47589] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|alloweddomain2\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "74"] [id "900001"] [msg "Blocked WP Login attempt on domain: sea-sound.com"] [severity "CRITICAL"] [tag "security"] [hostname "sea-sound.com"] [uri "/wp-login.php"] [unique_id "aip1R8c6cMSutqv1JrfLLwAAAIc"], referer: https://sea-sound.com/wp-login.php show less	Port Scan
🇺🇸 dtorrer	2026-06-10 21:28:19 (1 day ago)	Brute-force general attack.	Brute-Force
🇺🇸 floreriaexpress	2026-06-10 20:02:03 (1 day ago)	FakeADS-Anti: country:TH \| https://floreriaexpresschile.cl/wp-login.php	Bad Web Bot
🇲🇹 Malta	2026-06-10 04:45:33 (2 days ago)	209.50.185.104 - - [10/Jun/2026:06:45:33 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ... show more 209.50.185.104 - - [10/Jun/2026:06:45:33 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇦🇺 HJ5Ss4Ju	2026-06-10 03:10:05 (2 days ago)	Blocked by Wordfence (SID 6)	Web App Attack
🇫🇷 ELYAZ	2026-06-01 15:13:34 (1 week ago)	(y4) Failed scan -byebye- from 209.50.185.104 (TH/Thailand/-): (CF_ENABLE)	Hacking
🇺🇸 lostswordfish.com	2026-05-30 10:06:04 (1 week ago)	Wordfence waf block on ncrsol	Web App Attack
🇩🇪 pltcldvlpr	2026-05-12 08:09:14 (4 weeks ago)	CMS/framework probe. Matched path: 209.50.185.104 - - [12/May/2026:10:09:14 +0200] "GET http://state ... show more CMS/framework probe. Matched path: 209.50.185.104 - - [12/May/2026:10:09:14 +0200] "GET http://stateparl.de/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 301 178 "-" "curl/8.7.1" asn=200373 org="3xK Tech GmbH": 209.50.185.104 - - [12/May/2026:10:09:14 +0200] "GET http://stateparl.de/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 301 178 "-" "curl/8.7.1" asn=200373 org="3xK Tech GmbH" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:34:10 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:34:05.663357 2025] [security2:error] [pid 23648:tid 23648] [client 209.50.185.104:41369] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.homecheckinmaine.com"] [uri "/.git/HEAD"] [unique_id "aSUjraknCQmxvoSdjp12JwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:49:45 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:49:36.997236 2025] [security2:error] [pid 1647141:tid 1647208] [client 209.50.185.104:35993] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.ouye.net"] [uri "/.git/HEAD"] [unique_id "aSUZQNffCdpZ5cNrCNd4TgAAAUM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 00:46:20 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:46:14.788664 2025] [security2:error] [pid 14243:tid 14243] [client 209.50.185.104:41801] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.schmeagle.com"] [uri "/.svn/wc.db"] [unique_id "aST8VohnzNOPtBQBnmMfqgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 00:19:17 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.185.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:19:12.823750 2025] [security2:error] [pid 25848:tid 25848] [client 209.50.185.104:50449] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.flugstad.net"] [uri "/.git/HEAD"] [unique_id "aST2AFGGmmaP48hocUreEQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-02 16:18:21 (7 months ago)	This IP was involved in an brute force and password spray attack on 2025/11/02 07:08:47	Port Scan Brute-Force Exploited Host Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 176.65.139.63

🇨🇳 111.35.36.48

🇮🇷 80.191.201.60

🇺🇸 77.91.118.50

🇺🇸 74.235.100.142

🇩🇪 69.5.169.156

🇳🇱 45.148.10.151

🇳🇱 45.92.1.134

🇷🇴 2.57.122.238

🇳🇱 195.178.110.188

🇳🇱 176.65.140.201

🇳🇱 160.119.76.63

🇳🇱 51.158.205.203

🇬🇧 2a06:4880:c000::e6

🇮🇳 2001:4490:4070:fc57:d018:a274:4730:4a58

🇺🇸 216.244.83.58

🇺🇸 216.25.89.77

🇩🇪 213.209.159.56

🇹🇼 128.14.237.120

🇮🇳 110.226.177.17