JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.189.194

209.50.189.194 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 13%: ?

13%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.189.194

Whois 209.50.189.194

IP Abuse Reports for 209.50.189.194:

This IP address has been reported a total of 13 times from 10 distinct sources. 209.50.189.194 was first reported on November 2nd 2025, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-07-13 10:40:39 (20 hours ago)	CrowdSec: lrob/wp-xmlrpc-bf \| req: ["/xmlrpc.php"] \| UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... show more CrowdSec: lrob/wp-xmlrpc-bf \| req: ["/xmlrpc.php"] \| UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"] show less	Brute-Force Web App Attack
🇫🇷 Sklurk	2026-06-17 01:13:07 (3 weeks ago)	Web App Attack	Web App Attack
🇲🇹 Malta	2026-01-30 03:35:07 (5 months ago)	209.50.189.194 - - [30/Jan/2026:04:35:07 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT ... show more 209.50.189.194 - - [30/Jan/2026:04:35:07 +0100] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0" show less	Hacking Web App Attack
🇫🇷 Jean Valjean	2026-01-04 17:51:59 (6 months ago)	Fail2ban Caboom : xmlrpc.php Abuse	SQL Injection Web App Attack
🇮🇩 Burayot	2026-01-03 16:52:26 (6 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 209.50.189.194 (FR/France/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 209.50.189.194 (FR/France/-): 1 in the last 3600 secs show less	Web App Attack
🇫🇷 ingroscart.it	2025-11-25 11:16:22 (7 months ago)	(mod_security) mod_security triggered on hostname [redacted] 209.50.189.194 (FR/France/-)	SQL Injection
🇺🇸 TPI-Abuse	2025-11-25 04:18:39 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:18:32.655090 2025] [security2:error] [pid 22183:tid 22183] [client 209.50.189.194:17093] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "doctorspainmanagement.com"] [uri "/.env"] [unique_id "aSUuGMloe-wXYuJ4_3MF2AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 i-turnradio.nl	2025-11-24 06:59:35 (7 months ago)	2025-11-24 @ 07:59:34 (CET) ~ Blocked based on risk assessment and prior abuse reports	Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 06:43:37 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:43:21.392847 2025] [security2:error] [pid 29748:tid 29748] [client 209.50.189.194:41203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.peakagronomysolutions.com"] [uri "/.svn/wc.db"] [unique_id "aSP-iYw_y1Y45NLsG2R9aAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 06:00:00 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:59:37.513171 2025] [security2:error] [pid 24064:tid 24064] [client 209.50.189.194:47067] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.shahngalu.com"] [uri "/.git/HEAD"] [unique_id "aSP0SY6qch16GyIVOu6YKgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 03:48:41 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 22:48:33.858401 2025] [security2:error] [pid 18340:tid 18340] [client 209.50.189.194:14241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.simcorr.com"] [uri "/.svn/wc.db"] [unique_id "aSPVkYbq5LvN9wS4OnbSOgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 10dencehispahard SL	2025-11-19 07:46:46 (7 months ago)	WP probing for vulnerabilities	Hacking Exploited Host
Anonymous	2025-11-02 15:52:35 (8 months ago)	This IP was involved in an brute force and password spray attack on 2025/11/02 07:02:17	Port Scan Brute-Force Exploited Host Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.226.197.10

🇵🇰 182.191.193.41

🇫🇮 147.185.133.160

🇺🇸 147.185.132.65

🇧🇷 147.15.15.226

🇫🇷 85.217.140.34

🇮🇳 59.180.183.19

🇺🇸 50.116.72.139

🇩🇪 217.181.92.137

🇸🇬 193.37.32.18

🇳🇱 185.226.197.8

🇳🇱 185.226.197.7

🇺🇸 172.245.12.80

🇧🇪 172.217.41.221

🇩🇪 130.12.182.165

🇯🇵 124.45.39.194

🇮🇳 103.149.197.34

🇮🇳 103.109.110.170

🇺🇸 65.49.1.113

🇩🇪 64.144.210.150