JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.31.22

65.111.31.22 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 4%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.31.22

Whois 65.111.31.22

IP Abuse Reports for 65.111.31.22:

This IP address has been reported a total of 22 times from 14 distinct sources. 65.111.31.22 was first reported on June 28th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-08-21 21:50:15 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇲🇽 octageeks.com	2026-05-27 04:17:45 (2 months ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇫🇷 pm33	2026-05-25 22:29:34 (2 months ago)	Wordpress login attempts	Brute-Force
🇲🇹 Malta	2026-05-17 15:47:57 (3 months ago)	65.111.31.22 - - [17/May/2026:17:47:57 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 1 ... show more 65.111.31.22 - - [17/May/2026:17:47:57 +0200] "POST /xmlrpc.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" show less	Hacking Web App Attack VPN IP
🇦🇺 RedBear IT	2026-03-26 10:00:37 (4 months ago)	"DDoS against public endpoint"	DDoS Attack
🇫🇮 000rosiu	2026-02-11 16:09:23 (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 200373 (DREI-K-TECH-GMBH ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 200373 (DREI-K-TECH-GMBH) Protocol: HTTP/1.1 (GET method) Endpoint: /v2/.git/config Timestamp: 2026-02-11T16:04:16Z Ray ID: 9cc514c0ae37579c UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Report generated by Cloudflare-WAF-To-AbuseIPDB: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇳🇱 homeshowdomain.nl	2026-02-10 22:59:19 (6 months ago)	Auto-ban: >3000 req/min op 2026-02-10	Hacking Web App Attack SSH
🇨🇱 ifiguero	2026-02-10 06:29:23 (6 months ago)	Web Attack (\x00\x00\x00\x00\x00). 7d ban	Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 02:09:47 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:09:41.687636 2026] [security2:error] [pid 26530:tid 26530] [client 65.111.31.22:41743] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hydrogenplus.net"] [uri "/v2/.git/config"] [unique_id "aYqTZeahUxNq7CPGUUBFrQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 01:21:08 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 20:21:03.744496 2026] [security2:error] [pid 18352:tid 18352] [client 65.111.31.22:49667] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kh6jim.com"] [uri "/dev/.git/config"] [unique_id "aYqH_xwa5ASPvn7KYHPuXwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:24:34 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:24:31.131385 2025] [security2:error] [pid 9090:tid 9090] [client 65.111.31.22:38609] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.capitalacc.com"] [uri "/.git/HEAD"] [unique_id "aSUvf8p2r7sArf9o3h_jBAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:57:06 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:56:58.302344 2025] [security2:error] [pid 18712:tid 18712] [client 65.111.31.22:53941] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.realestateinpalmbeachflorida.com"] [uri "/.env"] [unique_id "aSUpCulrhrUDscuf3JieQAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:54:57 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:54:50.656418 2025] [security2:error] [pid 18178:tid 18178] [client 65.111.31.22:50533] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.pinehillwineworks.com"] [uri "/.svn/wc.db"] [unique_id "aSUaen3MnUeqrQVKTA5p5AAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:35:30 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:35:21.149133 2025] [security2:error] [pid 19348:tid 19348] [client 65.111.31.22:42655] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.partyinvitationsprinted.com"] [uri "/.env"] [unique_id "aSUV6TWzJHSf4yYZbsFtVAAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 00:36:19 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 65.111.31.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:36:11.925092 2025] [security2:error] [pid 1416453:tid 1416514] [client 65.111.31.22:57065] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.dontbeajerklikeyourwork.com"] [uri "/.env"] [unique_id "aST5-03b9nF_ETk_BjbEuAAAAkM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 222.116.59.127

🇦🇷 186.139.109.120

🇳🇱 77.239.124.251

🇺🇸 34.148.250.157

🇺🇸 162.216.150.100

🇺🇸 109.105.210.83

🇺🇸 73.157.1.151

🇬🇧 62.60.130.253

🇺🇸 20.64.105.215

🇻🇳 14.225.218.99

🇮🇳 168.144.65.188

🇳🇱 153.75.87.176

🇩🇴 148.0.118.151

🇺🇸 147.182.228.12

🇿🇦 105.184.204.17

🇫🇷 86.233.137.68

🇨🇳 39.162.165.255

🇨🇦 24.207.66.154

🇺🇸 109.105.210.85

🇨🇴 108.174.156.122