JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.191.139

209.50.191.139 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 42%: ?

42%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.191.139

Whois 209.50.191.139

IP Abuse Reports for 209.50.191.139:

This IP address has been reported a total of 23 times from 13 distinct sources. 209.50.191.139 was first reported on October 26th 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-07-08 01:47:16 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇨🇦 KIsmay	2026-07-07 12:01:37 (1 week ago)	Jul 7 08:01:28 www4 WPAudit[559977]: 209.50.191.139 terratherma.com "Mozilla/5.0 (Windows NT 10.0; ... show more Jul 7 08:01:28 www4 WPAudit[559977]: 209.50.191.139 terratherma.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" scott:grimmy FAIL Jul 7 08:01:30 www4 WPAudit[559979]: 209.50.191.139 terratherma.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" [email protected]:grimmy FAIL Jul 7 08:01:33 www4 WPAudit[559979]: 209.50.191.139 terratherma.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" terratherma.com:grimmy FAIL Jul 7 08:01:35 www4 WPAudit[559977]: 209.50.191.139 terratherma.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" admin:grimmy FAIL Jul 7 08:01:36 www4 WPAudit[559979]: 209.50.191.139 terratherma.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" administrator:grimmy FAIL ... show less	Brute-Force Web App Attack
🇲🇽 octageeks.com	2026-07-07 04:13:40 (1 week ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇫🇷 pm33	2026-07-07 01:18:40 (1 week ago)	Wordpress login attempts	Brute-Force
🇨🇦 electronico	2026-07-05 04:48:29 (1 week ago)	209.50.191.139 - - [05/Jul/2026:15:48:28 +1100] "POST /xmlrpc.php HTTP/1.1" 503 23185 "https://www.b ... show more 209.50.191.139 - - [05/Jul/2026:15:48:28 +1100] "POST /xmlrpc.php HTTP/1.1" 503 23185 "https://www.bing.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇫🇷 pm33	2026-07-02 02:11:59 (1 week ago)	Wordpress login attempts	Brute-Force
🇩🇪 georgengelmann	2026-06-30 10:31:54 (2 weeks ago)	Failed login attempt for siteseomanager461	Brute-Force Web App Attack
🇧🇪 Saec	2026-06-28 18:45:30 (2 weeks ago)	Jarvis auto-ban: CF honeypot path /wp-login.php (1× on saec.ovh)	Port Scan Web App Attack
🇫🇮 JimArchon72	2026-06-03 04:45:02 (1 month ago)	2026/06/03 04:44:07 "GET /wp-login.php?action=register HTTP/1.1"	Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (3 months ago)	"DDoS against public endpoint"	DDoS Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:00:56 (6 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-12-02 08:24:35 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 03:24:25.447012 2025] [security2:error] [pid 9433:tid 9433] [client 209.50.191.139:11155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tradersworldmarket.com"] [uri "/.env"] [unique_id "aS6iOQjnCfTLSKdnquyZdwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 08:08:07 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 03:08:00.090590 2025] [security2:error] [pid 28191:tid 28191] [client 209.50.191.139:49911] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dginstruments.com"] [uri "/.svn/wc.db"] [unique_id "aS6eYFKEfpE_MTBC3NZPKAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 05:41:50 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 00:41:43.307622 2025] [security2:error] [pid 31702:tid 31702] [client 209.50.191.139:29383] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "garciadomingo.com"] [uri "/.svn/wc.db"] [unique_id "aS58F72i6-JoiRoVwQh89wAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 04:31:37 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.191.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 23:31:32.111434 2025] [security2:error] [pid 23284:tid 23284] [client 209.50.191.139:36897] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gmroyalties.com"] [uri "/.svn/wc.db"] [unique_id "aS5rpLKBr-YnN1D2ow4vBAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 35.203.210.20

🇬🇧 193.32.209.234

🇧🇷 187.58.66.231

🇺🇸 162.216.150.161

🇮🇩 103.132.236.30

🇫🇷 91.196.152.197

🇧🇬 91.92.47.35

🇳🇱 89.248.172.11

🇱🇹 81.30.98.142

🇺🇸 66.132.172.246

🇩🇪 65.111.22.178

🇺🇸 65.49.20.68

🇺🇸 47.251.251.225

🇺🇸 20.221.69.50

🇮🇳 2409:40f2:102f:7fc3:988b:1f3b:9cc3:e6e6

🇺🇸 209.38.76.194

🇮🇩 143.14.13.49

🇨🇳 112.86.225.219

🇫🇮 80.66.83.80

🇦🇪 2.50.239.81