JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.189.223

209.50.189.223 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 36%: ?

36%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.189.223

Whois 209.50.189.223

IP Abuse Reports for 209.50.189.223:

This IP address has been reported a total of 21 times from 14 distinct sources. 209.50.189.223 was first reported on November 2nd 2025, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 hero2026	2026-08-23 23:55:13 (8 hours ago)	Blocked by Fail2ban	Web App Attack
🇺🇸 lostswordfish.com	2026-08-23 06:42:04 (1 day ago)	Wordfence waf block on restore georgia	Web App Attack
🇲🇽 octageeks.com	2026-08-23 04:14:52 (1 day ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇲🇹 Malta	2026-08-23 02:31:35 (1 day ago)	209.50.189.223 - - [23/Aug/2026:04:31:35 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; ... show more 209.50.189.223 - - [23/Aug/2026:04:31:35 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-08-21 21:50:34 (2 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇬🇧 PeravixGroup	2026-05-02 22:14:02 (3 months ago)	Honeypot detection: Memcached unauthorized access / amplification attempt on port 2375. Severity: HI ... show more Honeypot detection: Memcached unauthorized access / amplification attempt on port 2375. Severity: HIGH. Aaran.cloud show less	Hacking Exploited Host
🇩🇪 F242	2026-01-30 05:07:48 (6 months ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇩🇪 ps-center	2025-12-14 02:02:22 (8 months ago)	ABV: Web Attack GET /wp-includes/wlwmanifest.xml	Web Spam Hacking Bad Web Bot Web App Attack
Anonymous	2025-12-11 22:16:09 (8 months ago)	botnet	DDoS Attack
🇧🇪 madeit	2025-11-30 04:33:18 (8 months ago)		Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 06:10:49 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:10:43.890143 2025] [security2:error] [pid 13922:tid 13922] [client 209.50.189.223:40293] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jadonbooth.com"] [uri "/.svn/wc.db"] [unique_id "aSVIY6j0pq_a3NOeahjyRQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 05:44:07 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:43:44.030436 2025] [security2:error] [pid 14127:tid 14127] [client 209.50.189.223:40535] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.terrorismbooks.info"] [uri "/.svn/wc.db"] [unique_id "aSVCEFYsFFE6OcCfpmEqAgAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:10:25 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:10:20.075166 2025] [security2:error] [pid 15589:tid 15624] [client 209.50.189.223:17353] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.btoelsalvador.com"] [uri "/.svn/wc.db"] [unique_id "aSUsLCIjVFKa_KFJ49h5lQAAANM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:50:57 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:50:50.721190 2025] [security2:error] [pid 4532:tid 4532] [client 209.50.189.223:48195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.hawarcenter.com"] [uri "/.svn/wc.db"] [unique_id "aSUZirlrcidmbDqEwc73SwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:27:34 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.189.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:27:27.901868 2025] [security2:error] [pid 20786:tid 20786] [client 209.50.189.223:15027] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.hakanbasboga.com"] [uri "/.svn/wc.db"] [unique_id "aSUUDw8ICrB9FOF6xl5McQAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 190.99.152.82

🇺🇸 73.165.120.60

🇺🇸 48.47.32.243

🇮🇳 115.98.152.185

🇲🇷 82.151.84.22

🇺🇸 72.174.73.62

🇺🇸 71.204.98.188

🇸🇬 47.84.139.61

🇳🇴 20.100.175.163

🇺🇸 216.25.89.125

🇺🇸 195.184.76.178

🇵🇭 180.195.73.5

🇸🇪 90.226.223.18

🇳🇱 89.21.67.174

🇺🇸 68.205.203.43

🇺🇸 68.80.109.152

🇺🇸 216.218.206.77

🇫🇮 147.185.133.205

🇺🇸 135.237.126.205

🇧🇬 78.128.114.162