JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.28.188

65.111.28.188 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 43%: ?

43%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.28.188

Whois 65.111.28.188

IP Abuse Reports for 65.111.28.188:

This IP address has been reported a total of 30 times from 17 distinct sources. 65.111.28.188 was first reported on June 27th 2024, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇷 setupgr	2026-06-17 18:43:38 (17 hours ago)	(mod_security) mod_security (id:900001) triggered by 65.111.28.188 (IT/Italy/Lazio/Rome/-/[AS200373 ... show more (mod_security) mod_security (id:900001) triggered by 65.111.28.188 (IT/Italy/Lazio/Rome/-/[AS200373 DREI-K-TECH-GMBH]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Jun 17 21:43:36.320843 2026] [security2:error] [pid 2210175:tid 2210245] [client 65.111.28.188:51971] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|sea-sound\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "75"] [id "900001"] [msg "Blocked WP Login attempt on domain: cpanagiotou.gr"] [severity "CRITICAL"] [tag "security"] [hostname "cpanagiotou.gr"] [uri "/wp-login.php"] [unique_id "ajLq2H9oGssBgNwsPFuhUgAAAE8"], referer: https://cpanagiotou.gr/wp-login.php show less	Port Scan
🇲🇹 Malta	2026-06-16 23:15:24 (1 day ago)	65.111.28.188 - - [17/Jun/2026:01:15:24 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh ... show more 65.111.28.188 - - [17/Jun/2026:01:15:24 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
Anonymous	2026-06-14 16:31:23 (3 days ago)	[server.tmg.gr] httpd-login-spray-site: sites=crisis-management2018.eu; logs=/var/log/httpd/domains/ ... show more [server.tmg.gr] httpd-login-spray-site: sites=crisis-management2018.eu; logs=/var/log/httpd/domains/crisis-management2018.eu.log; samples=site_wide=true \| distinct_ips=12 \| /wp-login.php show less	Hacking Web App Attack
🇲🇹 Malta	2026-06-14 12:26:54 (3 days ago)	65.111.28.188 - - [14/Jun/2026:14:26:54 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh ... show more 65.111.28.188 - - [14/Jun/2026:14:26:54 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0" show less	Hacking Web App Attack
🇫🇷 solution.it	2026-06-13 20:48:47 (4 days ago)	[Sat Jun 13 22:48:46.732959 2026] [php7:error] [pid 3456707:tid 3456707] [client 65.111.28.188:35119 ... show more [Sat Jun 13 22:48:46.732959 2026] [php7:error] [pid 3456707:tid 3456707] [client 65.111.28.188:35119] script '/var/www/html/blog.solution.it/wp-login.php' not found or unable to stat, referer: https://blog.solution.it/wp-login.php show less	Web App Attack
Anonymous	2026-06-11 11:41:20 (1 week ago)	[ns31.kdns.gr] httpd-login-spray-site: sites=esperohotel.gr; logs=/var/log/httpd/domains/esperohotel ... show more [ns31.kdns.gr] httpd-login-spray-site: sites=esperohotel.gr; logs=/var/log/httpd/domains/esperohotel.gr.log; samples=site_wide=true \| distinct_ips=16 \| /wp-login.php show less	Hacking Web App Attack
🇲🇽 octageeks.com	2026-06-11 04:23:01 (1 week ago)	Wordpress malicious attack:[octaflood]	Web App Attack
Anonymous	2026-06-11 01:20:25 (1 week ago)	Web attack blocked by Wordfence on helenehoenjet.nl (1 hit). Reported by CRMON.	Web App Attack
🇺🇸 lostswordfish.com	2026-06-10 07:52:06 (1 week ago)	Wordfence waf block on kcuar	Web App Attack
🇨🇳 ThreatBook.io	2026-05-15 23:32:09 (1 month ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/65.111.28.188 2026-05-15 15 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/65.111.28.188 2026-05-15 15:10:44 / 2026-05-15 14:43:00 / 2026-05-15 14:43:22 / 2026-05-15 14:38:46 / show less	Web App Attack
🇫🇮 as211431.net	2026-04-14 04:46:23 (2 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /index.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-03-23 16:44:51 (2 months ago)	Forum/form spam	Web Spam
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:32 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-11-26 11:34:29 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.28.188 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 65.111.28.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:34:24.725091 2025] [security2:error] [pid 27610:tid 27610] [client 65.111.28.188:9643] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.norinpaco.com"] [uri "/.git/HEAD"] [unique_id "aSblwLMtEh4C7RzsgHzBDgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 07:17:40 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.28.188 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 65.111.28.188 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 02:17:34.303725 2025] [security2:error] [pid 26247:tid 26247] [client 65.111.28.188:20137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cafink.name"] [uri "/.env"] [unique_id "aSapjlfjEmmACtibrx4gvAAAABc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇹 2001:690:200c:3:9999::228

🇮🇹 94.177.162.41

🇸🇬 82.38.180.36

🇺🇸 50.116.23.178

🇱🇹 45.227.254.170

🇳🇱 45.148.10.157

🇨🇳 39.96.197.8

🇰🇷 222.110.147.58

🇳🇱 195.178.110.30

🇩🇪 185.252.166.161

🇮🇹 185.100.34.104

🇮🇩 182.13.96.107

🇭🇰 103.229.126.95

🇩🇪 79.220.120.149

🇻🇳 222.253.152.149

🇦🇱 188.93.112.20

🇨🇴 186.96.97.181

🇸🇬 174.138.17.143

🇨🇳 118.145.238.60

🇸🇬 118.26.111.107