JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.28.220

65.111.28.220 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 57%: ?

57%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.28.220

Whois 65.111.28.220

IP Abuse Reports for 65.111.28.220:

This IP address has been reported a total of 41 times from 23 distinct sources. 65.111.28.220 was first reported on July 18th 2024, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 ddw	2026-07-11 05:58:12 (5 hours ago)	WordPress Brute Force Attack.	Hacking Brute-Force Web App Attack
🇲🇹 Malta	2026-07-09 12:57:42 (1 day ago)	65.111.28.220 - - [09/Jul/2026:14:57:42 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Linu ... show more 65.111.28.220 - - [09/Jul/2026:14:57:42 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇬🇧 gigatech	2026-07-09 07:40:17 (2 days ago)	Webserver Probing	Web App Attack
🇫🇷 Sklurk	2026-07-08 01:34:33 (3 days ago)	Web App Attack	Web App Attack
🇮🇹 Inartis	2026-06-29 11:13:37 (1 week ago)	65.111.28.220 - - [29/Jun/2026:13:13:36 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5159 "https://t.co/" ... show more 65.111.28.220 - - [29/Jun/2026:13:13:36 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5159 "https://t.co/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0" ... show less	Brute-Force Bad Web Bot Web App Attack
🇲🇹 Malta	2026-06-24 16:07:57 (2 weeks ago)	65.111.28.220 - - [24/Jun/2026:18:07:57 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows N ... show more 65.111.28.220 - - [24/Jun/2026:18:07:57 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇫🇷 ELYAZ	2026-06-24 04:16:58 (2 weeks ago)	(y4) Failed scan -byebye- from 65.111.28.220 (IT/Italy/-): (CF_ENABLE)	Hacking
🇩🇪 Spiderpiggy	2026-06-23 17:26:45 (2 weeks ago)	Automatically reported via Blackhole honeypot on games4you.be. Attempted access to restricted endpoi ... show more Automatically reported via Blackhole honeypot on games4you.be. Attempted access to restricted endpoint: /wp-login.php show less	Brute-Force Bad Web Bot SSH
🇬🇧 poundawebsiteltd	2026-06-19 23:48:55 (3 weeks ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.28.220 - - [20/Jun/2026:00:48:50 +0100] P ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 65.111.28.220 - - [20/Jun/2026:00:48:50 +0100] POST /wp-login.php HTTP/1.1 200 7364 https://[REDACTED_DOMAIN]/wp-login.php Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:119.0) Gecko/20100101 Firefox/119.0 show less	Web App Attack
🇫🇷 mrcrassi	2026-06-17 16:05:38 (3 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (POST meth ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇷 setupgr	2026-06-15 22:00:48 (3 weeks ago)	(mod_security) mod_security (id:900001) triggered by 65.111.28.220: 1 in the last 86400 secs; Ports: ... show more (mod_security) mod_security (id:900001) triggered by 65.111.28.220: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jun 16 01:00:48.223821 2026] [security2:error] [pid 1965768:tid 1965808] [client 65.111.28.220:63065] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|sea-sound\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "74"] [id "900001"] [msg "Blocked WP Login attempt on domain: mail.ions.gr"] [severity "CRITICAL"] [tag "security"] [hostname "mail.ions.gr"] [uri "/wp-login.php"] [unique_id "ajB2EJhSggell5vQAURiSQAAAU0"], referer: https://mail.ions.gr/wp-login.php show less	Port Scan
🇫🇷 ELYAZ	2026-06-14 17:32:46 (3 weeks ago)	(y4) Failed scan -byebye- from 65.111.28.220 (IT/Italy/-): (CF_ENABLE)	Hacking
Anonymous	2026-06-14 12:18:44 (3 weeks ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇺🇸 lostswordfish.com	2026-06-13 07:12:03 (4 weeks ago)	Wordfence waf block on ohrsol	Web App Attack
🇫🇷 ELYAZ	2026-06-12 01:51:19 (4 weeks ago)	(y4) Failed scan -byebye- from 65.111.28.220 (IT/Italy/-): (CF_ENABLE)	Hacking

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.206

🇩🇪 185.242.3.184

🇺🇸 162.216.149.128

🇺🇸 162.216.149.76

🇺🇸 104.28.219.193

🇭🇰 101.36.124.220

🇺🇸 43.173.97.63

🇬🇧 35.203.210.55

🇺🇸 172.234.199.93

🇺🇸 172.202.114.25

🇺🇸 136.36.189.65

🇮🇩 103.176.78.149

🇧🇩 103.112.54.86

🇷🇺 80.249.147.192

🇺🇸 51.81.33.138

🇺🇸 44.164.133.212

🇺🇸 40.119.29.137

🇬🇧 35.203.210.106

🇷🇺 5.101.64.6

🇬🇧 185.91.69.65