JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.3.138

65.111.3.138 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 9%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.3.138

Whois 65.111.3.138

IP Abuse Reports for 65.111.3.138:

This IP address has been reported a total of 27 times from 19 distinct sources. 65.111.3.138 was first reported on July 7th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 inlink.ltd	2026-05-26 08:39:47 (1 week ago)	Known malicious PHP file or CMS probe	Web App Attack
🇩🇪 Bedios GmbH	2026-04-20 08:21:35 (1 month ago)	SQL backup theft attempt	Hacking
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇩🇪 F242	2026-01-30 05:12:49 (4 months ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇺🇸 TPI-Abuse	2026-01-30 02:25:07 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 21:25:02.207282 2026] [security2:error] [pid 1811357:tid 1811357] [client 65.111.3.138:50333] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jolankagroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXwWfrYWq2fLHmUg_76aFAAAAAQ"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 sefinek.net	2026-01-03 08:08:54 (5 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 mind5t0rm	2026-01-02 13:57:44 (5 months ago)	(XMLRPC) WP XMLPRC Attack 65.111.3.138 (US/United States/-): 3 in the last 3600 secs; Ports: ; Dire ... show more (XMLRPC) WP XMLPRC Attack 65.111.3.138 (US/United States/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: 65.111.3.138 - - [02/Jan/2026:20:57:40 +0700] "POST /xmlrpc.php HTTP/1.1" 403 155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 65.111.3.138 - - [02/Jan/2026:20:57:40 +0700] "POST /xmlrpc.php HTTP/1.1" 403 155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 65.111.3.138 - - [02/Jan/2026:20:57:41 +0700] "POST /xmlrpc.php HTTP/1.1" 403 155 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Port Scan
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:20 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-11-25 07:01:48 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:01:42.731909 2025] [security2:error] [pid 27570:tid 27570] [client 65.111.3.138:46279] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kidswow.net"] [uri "/.git/HEAD"] [unique_id "aSVUVgwbOP7fzOi0bBrEMQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 06:43:29 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:43:21.967271 2025] [security2:error] [pid 927608:tid 927608] [client 65.111.3.138:11197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.readyaiminspire.com"] [uri "/.svn/wc.db"] [unique_id "aSVQCdokOSOu8AGIUr03kAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 06:19:00 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:18:57.717344 2025] [security2:error] [pid 14585:tid 14585] [client 65.111.3.138:53653] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nationalnova.com"] [uri "/.env"] [unique_id "aSVKUXbHdBrob6ZbILsnvQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:06:02 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.3.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:05:58.114300 2025] [security2:error] [pid 10708:tid 10708] [client 65.111.3.138:48289] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "deborbon.me"] [uri "/.svn/wc.db"] [unique_id "aSUdFvjr75EBXbaBpQ5aLgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-14 00:04:48 (6 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-11-02 19:54:18 (7 months ago)	This IP was involved in an brute force and password spray attack on 2025/11/02 06:54:54	Port Scan Brute-Force Exploited Host Web App Attack
Anonymous	2025-10-13 15:53:48 (7 months ago)	Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failu ... show more Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failures with varying usernames. show less	Brute-Force

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.223.107.86

🇨🇳 180.95.238.196

🇻🇳 171.251.238.96

🇸🇬 152.42.217.112

🇨🇳 111.26.106.119

🇬🇧 92.118.60.128

🇨🇴 181.119.85.215

🇨🇳 144.123.77.64

🇨🇳 139.9.191.197

🇰🇷 122.202.250.160

🇵🇱 87.251.64.176

🇨🇳 59.59.212.49

🇩🇪 43.228.157.8

🇮🇳 20.193.250.198

🇷🇴 2.57.121.112

🇺🇸 2604:a880:400:d1:0:4:8bf7:6001

🇵🇦 190.97.165.93

🇲🇴 182.93.50.90

🇳🇱 157.245.79.143

🇧🇬 79.124.62.178