JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.3.105

65.111.3.105 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 26%: ?

26%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.3.105

Whois 65.111.3.105

IP Abuse Reports for 65.111.3.105:

This IP address has been reported a total of 49 times from 23 distinct sources. 65.111.3.105 was first reported on July 13th 2024, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 FDC	2026-07-09 07:00:46 (19 hours ago)	Malicious activity from 65.111.3.105 detected by FDC honeypots. Categories: 14,15,21. 26 events in l ... show more Malicious activity from 65.111.3.105 detected by FDC honeypots. Categories: 14,15,21. 26 events in last 24h. show less	Port Scan Hacking Web App Attack
🇫🇷 Sklurk	2026-07-07 16:24:14 (2 days ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-06-20 02:21:57 (2 weeks ago)	Web App Attack	Web App Attack
🇬🇧 PeravixGroup	2026-06-09 21:16:40 (1 month ago)	Honeypot detection: Apache CouchDB unauthorized access / exploitation attempt on port 5984. Severity ... show more Honeypot detection: Apache CouchDB unauthorized access / exploitation attempt on port 5984. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇫🇷 masterguru	2026-06-03 06:01:32 (1 month ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 65.111.3.105 (US/United States/-): 1 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 65.111.3.105 (US/United States/-): 1 in the last 3600 secs (0-195) show less	Hacking
Anonymous	2026-06-02 17:14:17 (1 month ago)	Malicious activity detected	Hacking Web App Attack
🇫🇷 masterguru	2026-03-30 07:43:55 (3 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 65.111.3.105 (US/United States/-): 1 in the la ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 65.111.3.105 (US/United States/-): 1 in the last 3600 secs (0-193) show less	Hacking
🇱🇻 garmtech.com	2026-03-14 23:51:43 (3 months ago)	IM360 WAF: WordPress plugin/theme auto install block	Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 08:56:11 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 03:56:07.402019 2026] [security2:error] [pid 9894:tid 9894] [client 65.111.3.105:37461] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lamanchaorchards.com"] [uri "/test/.git/config"] [unique_id "aY7nJxreA1SbAHOHDlqaCwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 07:05:24 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 02:05:18.978066 2026] [security2:error] [pid 22681:tid 22681] [client 65.111.3.105:52783] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ktnwassociatesinc.com"] [uri "/app/.git/config"] [unique_id "aY7NLsxAvD_w1uXztl2jQQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 06:00:14 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 01:00:09.789659 2026] [security2:error] [pid 2717920:tid 2717920] [client 65.111.3.105:9425] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "konzel.com"] [uri "/backend/.env"] [unique_id "aY696RsiHYN-KvMMpMQffAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 05:36:27 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 00:36:18.527002 2026] [security2:error] [pid 23655:tid 23655] [client 65.111.3.105:48339] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kofcasamblea442.org"] [uri "/.env"] [unique_id "aY64UhJkXUtMsCRUltYUjgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-13 05:07:02 (4 months ago)	Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /site/.git/config HTTP/1.1, GET ... show more Bot / scanning and/or hacking attempts: GET /.env.save HTTP/1.1, GET /site/.git/config HTTP/1.1, GET /backend/.env HTTP/1.1, GET /app/.git/config HTTP/1.1, GET /api/.git/config HTTP/1.1, GET /new/.git/config HTTP/1.1, GET /.git/config HTTP/1.1, GET /app/.env HTTP/1.1, GET /frontend/.env HTTP/1.1, GET /dev/.git/config HTTP/1.1, GET /.env.local HTTP/1.1, GET /backup/.git/config HTTP/1.1, GET /config/.env HTTP/1.1, GET /.aws/credentials HTTP/1.1, GET /admin/.env HTTP/1.1, GET /v2/.git/config HTTP/1.1, GET /wp/.git/config HTTP/1.1, GET /admin/.git/config HTTP/1.1, GET /test/.git/config HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 02:59:42 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 21:59:35.098122 2026] [security2:error] [pid 18128:tid 18128] [client 65.111.3.105:51447] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kevinfranz.com"] [uri "/backup/.git/config"] [unique_id "aY6Tl7puhIRHpRBYOD1ZjwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 00:09:14 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 19:09:07.417015 2026] [security2:error] [pid 4178406:tid 4178406] [client 65.111.3.105:46307] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aguitas.com"] [uri "/.git/config"] [unique_id "aY5ro1Etn6FnQRFOmqyu5wAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 172.68.151.30

🇹🇼 198.235.24.110

🇲🇰 188.44.20.31

🇦🇷 181.9.227.145

🇧🇷 179.190.105.147

🇳🇱 172.71.183.25

🇺🇸 162.216.150.190

🇺🇸 157.245.10.25

🇺🇸 147.185.132.159

🇺🇸 147.182.207.197

🇺🇸 91.230.168.20

🇫🇷 91.196.152.36

🇫🇮 80.223.190.179

🇺🇸 71.6.240.246

🇺🇸 71.6.134.204

🇲🇾 47.250.123.22

🇳🇱 45.148.10.152

🇮🇩 36.64.68.99

🇺🇸 20.81.47.184

🇩🇪 213.209.159.226