JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.25.4

65.111.25.4 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 28%: ?

28%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.25.4

Whois 65.111.25.4

IP Abuse Reports for 65.111.25.4:

This IP address has been reported a total of 34 times from 19 distinct sources. 65.111.25.4 was first reported on July 2nd 2024, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-07-08 01:33:13 (18 hours ago)	Web App Attack	Web App Attack
Anonymous	2026-07-05 20:44:50 (2 days ago)	B: f2b asterisk aggressive 3x	Email Spam
🇫🇮 sgofferj	2026-07-03 23:46:54 (4 days ago)	Attack attempt on SIP server	Fraud VoIP Hacking Brute-Force
🇮🇹 Francesco Ippoliti	2026-07-03 22:46:24 (4 days ago)	[Jul 4 00:46:23] NOTICE[65286] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:8880@15 ... show more [Jul 4 00:46:23] NOTICE[65286] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '65.111.25.4:63175' (callid: cf9dfd9b406c6514b089e1c73a35e1d8) - No matching endpoint found [Jul 4 00:46:23] NOTICE[66068] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '65.111.25.4:63175' (callid: cf9dfd9b406c6514b089e1c73a35e1d8) - No matching endpoint found ... show less	Brute-Force Port Scan
🇮🇹 Francesco Ippoliti	2026-07-03 20:47:51 (4 days ago)	[Jul 3 22:47:51] NOTICE[64812] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:401@154 ... show more [Jul 3 22:47:51] NOTICE[64812] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '65.111.25.4:13172' (callid: ecd6435f1afd4eac2a28c5c22e3bc86f) - No matching endpoint found [Jul 3 22:47:51] NOTICE[65286] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '<sip:[email protected]>' failed for '65.111.25.4:13172' (callid: ecd6435f1afd4eac2a28c5c22e3bc86f) - No matching endpoint found ... show less	Brute-Force Port Scan
Anonymous	2026-01-14 08:17:44 (5 months ago)	"GET /.git/HEAD HTTP/1.1"	Hacking Web App Attack
🇳🇱 BlueWire Hosting	2026-01-13 06:29:52 (5 months ago)	Probing websites for vulnerabilities	Web App Attack
Anonymous	2026-01-05 20:24:52 (6 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:52 (6 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇫🇷 pm33	2025-11-27 00:06:31 (7 months ago)	Probing for resource vulnerabilities HTTP(S)	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 21:24:52 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 16:24:45.867593 2025] [security2:error] [pid 3412217:tid 3412217] [client 65.111.25.4:37559] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.srtmanagementservices.com"] [uri "/.svn/wc.db"] [unique_id "aSdwHQDAyBtfBWWsAwZdEwAAACQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 12:22:50 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 07:22:46.321591 2025] [security2:error] [pid 29564:tid 29564] [client 65.111.25.4:44009] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uppercervicaloc.daebakdesign.com"] [uri "/.svn/wc.db"] [unique_id "aSbxFhM787p1_cYRkZLudgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 03:16:05 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 22:16:01.762328 2025] [security2:error] [pid 13466:tid 13466] [client 65.111.25.4:19219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.likeafeather.com"] [uri "/.svn/wc.db"] [unique_id "aSZw8cGrDBo5nz05ysybWQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 02:13:29 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 21:13:23.396123 2025] [security2:error] [pid 30477:tid 30477] [client 65.111.25.4:30671] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.predeity.com"] [uri "/.svn/wc.db"] [unique_id "aSZiQ1oLRM_J2jVjVOeT1wAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 05:29:28 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.25.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:29:20.557694 2025] [security2:error] [pid 11467:tid 11467] [client 65.111.25.4:24393] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.memphislimousines.com"] [uri "/.env"] [unique_id "aSU-sC1sVi1_v0mFp48o1wAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 208.115.214.194

🇩🇪 167.94.146.58

🇹🇼 111.248.43.54

🇨🇦 85.217.149.48

🇺🇸 20.118.225.19

🇨🇳 14.103.121.78

🇺🇸 216.25.89.83

🇧🇷 205.210.31.255

🇲🇽 201.123.116.23

🇺🇸 147.185.132.189

🇮🇳 103.50.150.172

🇳🇱 91.92.42.80

🇺🇸 66.132.224.43

🇰🇷 211.223.107.86

🇺🇸 195.184.76.54

🇺🇸 147.182.177.180

🇨🇳 101.96.195.62

🇸🇬 94.231.206.134

🇫🇷 91.231.89.177

🇫🇷 91.231.89.58