JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.2.106

65.111.2.106 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.2.106

Whois 65.111.2.106

IP Abuse Reports for 65.111.2.106:

This IP address has been reported a total of 39 times from 22 distinct sources. 65.111.2.106 was first reported on June 28th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇹 Malta	2026-07-01 21:18:28 (1 month ago)	65.111.2.106 - - [01/Jul/2026:23:18:27 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT ... show more 65.111.2.106 - - [01/Jul/2026:23:18:27 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" show less	Hacking Web App Attack
🇺🇸 lostswordfish.com	2026-06-16 20:58:04 (2 months ago)	Wordfence waf block on decarcerationnation	Web App Attack
🇩🇪 georgengelmann	2026-06-16 10:11:25 (2 months ago)	Failed login attempt for admin	Brute-Force Web App Attack
🇩🇪 Bedios GmbH	2026-06-14 09:25:33 (2 months ago)	SQL backup theft attempt	Hacking
🇲🇽 octageeks.com	2026-06-13 04:12:00 (2 months ago)	Wordpress malicious attack:[octaflood]	Web App Attack
Anonymous	2026-06-12 14:21:12 (2 months ago)	Web attack blocked by Wordfence on gedichtenlangsdegeul.nl (1 hit). Reported by CRMON.	Web App Attack
🇩🇪 filstal.org	2026-06-09 22:48:46 (2 months ago)	Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels an ... show more Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 show less	Hacking Brute-Force Web App Attack
🇺🇸 mnsf	2026-06-04 19:08:04 (2 months ago)	Abuse Detected (1)	Brute-Force Web App Attack
Anonymous	2026-06-02 07:00:55 (2 months ago)	[da.kdns.gr] httpd-login-spray-site: sites=trikoilis.com; logs=/var/log/httpd/domains/trikoilis.com. ... show more [da.kdns.gr] httpd-login-spray-site: sites=trikoilis.com; logs=/var/log/httpd/domains/trikoilis.com.log; samples=site_wide=true \| distinct_ips=54 \| /wp-login.php show less	Hacking Web App Attack
🇫🇷 ELYAZ	2026-06-01 16:25:33 (2 months ago)	(y4) Failed scan -byebye- from 65.111.2.106 (US/United States/-): (CF_ENABLE)	Hacking
🇦🇺 2000cn.com.au	2026-04-19 06:11:50 (4 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇮🇩 Burayot	2026-04-18 12:40:05 (4 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 65.111.2.106 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 65.111.2.106 (US/United States/-): 2 in the last 3600 secs show less	Web App Attack
🇳🇱 jjnxpct	2025-11-26 04:56:25 (8 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /.env] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 06:13:48 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.2.106 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.2.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:13:41.612564 2025] [security2:error] [pid 10619:tid 10732] [client 65.111.2.106:34401] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.retrieversocal.com"] [uri "/.env"] [unique_id "aSVJFQXcnVrJOg7V-2KA6gAAARY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:22:04 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.2.106 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.2.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:21:54.872575 2025] [security2:error] [pid 8520:tid 8520] [client 65.111.2.106:34541] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.montebiancoltd.com"] [uri "/.env"] [unique_id "aSUg0oIQjHDpV226Fz48RQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 210.79.142.201

🇷🇴 193.46.255.86

🇨🇳 180.103.59.84

🇺🇸 35.237.250.89

🇸🇦 2a02:9b0:4046:8fcf:24ec:4c43:694c:4490

🇺🇸 185.251.19.85

🇨🇳 182.204.177.74

🇺🇸 170.187.165.242

🇵🇭 165.154.100.252

🇦🇺 140.238.207.64

🇺🇸 136.242.123.151

🇨🇳 123.117.152.61

🇨🇳 111.224.74.15

🇺🇸 107.23.138.73

🇮🇳 59.179.31.237

🇳🇱 193.107.20.21

🇳🇱 193.47.62.69

🇪🇨 186.68.83.105

🇭🇰 172.253.6.22

🇺🇸 172.237.137.89