JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.3.59

65.111.3.59 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 46%: ?

46%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.3.59

Whois 65.111.3.59

IP Abuse Reports for 65.111.3.59:

This IP address has been reported a total of 30 times from 20 distinct sources. 65.111.3.59 was first reported on July 9th 2024, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 ddw	2026-06-15 04:56:35 (6 hours ago)	WordPress Brute Force Attack.	Hacking Brute-Force Web App Attack
🇫🇷 ELYAZ	2026-06-14 00:15:39 (1 day ago)	(y4) Failed scan -byebye- from 65.111.3.59 (US/United States/-): (CF_ENABLE)	Hacking
🇲🇹 Malta	2026-06-12 08:44:54 (3 days ago)	65.111.3.59 - - [12/Jun/2026:10:44:54 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT ... show more 65.111.3.59 - - [12/Jun/2026:10:44:54 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0" show less	Hacking Web App Attack
🇳🇿 billyborsht	2026-06-11 01:52:53 (4 days ago)	2026-06-11T13:52:52.776165+12:00 southern wordpress(abrahamic.nz)[556019]: Authentication attempt fo ... show more 2026-06-11T13:52:52.776165+12:00 southern wordpress(abrahamic.nz)[556019]: Authentication attempt for unknown user root from 65.111.3.59 ... show less	Hacking Web App Attack
Anonymous	2026-06-02 07:01:01 (1 week ago)	[da.kdns.gr] httpd-login-spray-site: sites=trikoilis.com; logs=/var/log/httpd/domains/trikoilis.com. ... show more [da.kdns.gr] httpd-login-spray-site: sites=trikoilis.com; logs=/var/log/httpd/domains/trikoilis.com.log; samples=site_wide=true \| distinct_ips=54 \| /wp-login.php show less	Hacking Web App Attack
🇫🇷 ELYAZ	2026-05-31 10:33:31 (2 weeks ago)	(y4) Failed scan -byebye- from 65.111.3.59 (US/United States/-): (CF_ENABLE)	Hacking
🇩🇪 4server	2026-05-20 13:36:41 (3 weeks ago)	[WedMay2015:36:38.7020822026][security2:error][pid363059:tid363116][client65.111.3.59:0]ModSecurity: ... show more [WedMay2015:36:38.7020822026][security2:error][pid363059:tid363116][client65.111.3.59:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.hopitalprovidence.org\"][uri\"/\"][unique_id\"ag245kz3q5_gtPx1tMnVzwAAAFQ\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-05-20 12:03:45 (3 weeks ago)	Try to access /.aws/credentials	Web App Attack
🇪🇸 librebit	2026-05-17 07:02:54 (4 weeks ago)	Brute force	Brute-Force
🇺🇸 TPI-Abuse	2026-04-30 00:08:18 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 65.111.3.59 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 65.111.3.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 20:08:14.587456 2026] [security2:error] [pid 29673:tid 29673] [client 65.111.3.59:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.luisguacache.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.luisguacache.com"] [uri "/s3cmd.ini"] [unique_id "afKdbmmiWq2HFV0YcRIddwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-04-29 11:53:37 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇩🇪 bescared	2026-04-27 06:43:04 (1 month ago)	F2B - Malicious activity detected. URL Probing. -8ff06ede-	Hacking Bad Web Bot Web App Attack
🇨🇿 lp	2026-03-05 01:34:53 (3 months ago)	Unauthorized VPN login attempts: 3 attempts were recorded from 65.111.3.59 2026-03-05T01:09:09+01:00 ... show more Unauthorized VPN login attempts: 3 attempts were recorded from 65.111.3.59 2026-03-05T01:09:09+01:00 vpn Access-Reject 'sotv02' station: 65.111.3.59 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-03-05T01:09:09+01:00 vpn Access-Reject 'pilo00' station: 65.111.3.59 auth-type: PAP realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-03-05T01:09:09+01:00 vpn Access-Reject 'tros01' station: 65.111.3.59 auth-type: PAP realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-12-03 05:41:09 (6 months ago)	(mod_security) mod_security (id:210740) triggered by 65.111.3.59 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210740) triggered by 65.111.3.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 03 00:40:40.255910 2025] [security2:error] [pid 14062:tid 14062] [client 65.111.3.59:59175] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy\|\|www.powerkiteforum.com\|F\|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "www.powerkiteforum.com"] [uri "/gastenboek.php"] [unique_id "aS_NWKqwy3hQU3Je_twYwAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-03 04:42:05 (6 months ago)	(mod_security) mod_security (id:210740) triggered by 65.111.3.59 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210740) triggered by 65.111.3.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 23:42:00.123974 2025] [security2:error] [pid 18703:tid 18721] [client 65.111.3.59:32799] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/Proxy-Connection/" at TX:header_name. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "33"] [id "210740"] [rev "2"] [msg "COMODO WAF: HTTP header is restricted by policy\|\|vtweaversguild.org\|F\|4"] [data "/Proxy-Connection/"] [severity "WARNING"] [tag "CWAF"] [tag "HTTP"] [hostname "vtweaversguild.org"] [uri "/VWG-FORUM/scarbook.php"] [unique_id "aS-_mDnqI4ZRPXHC0lZ1bQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 45.227.254.170

🇹🇼 35.221.216.150

🇫🇮 35.217.37.212

🇬🇪 2.57.217.229

🇵🇭 165.154.100.252

🇯🇵 163.43.230.67

🇸🇬 152.42.190.92

🇺🇸 91.230.168.132

🇺🇸 50.46.141.125

🇳🇱 5.187.35.142

🇺🇸 2604:a880:400:d1:0:4:9620:3001

🇷🇺 217.150.37.249

🇺🇸 216.180.246.162

🇩🇪 193.124.20.231

🇨🇭 179.43.163.26

🇨🇳 175.178.53.31

🇯🇵 163.43.229.96

🇺🇸 43.153.77.90

🇫🇷 185.135.137.194

🇯🇵 163.43.230.221