JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.111.7.64

65.111.7.64 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 29%: ?

29%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.111.7.64

Whois 65.111.7.64

IP Abuse Reports for 65.111.7.64:

This IP address has been reported a total of 25 times from 13 distinct sources. 65.111.7.64 was first reported on June 26th 2024, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-06-11 11:14:05 (10 hours ago)	Web App Attack	Web App Attack
🇺🇸 koinkash.org	2026-06-10 20:10:31 (1 day ago)	They are fraudulent. Malicious threat actor requesting php file /wp-login.php	Web App Attack
🇫🇷 ELYAZ	2026-06-09 20:35:53 (2 days ago)	(y4) Failed scan -byebye- from 65.111.7.64 (US/United States/-): (CF_ENABLE)	Hacking
🇪🇸 librebit	2026-05-13 23:37:19 (4 weeks ago)	Brute force	Brute-Force
Anonymous	2026-05-13 22:05:39 (4 weeks ago)	Multiple failed login attemps RDS-Web-Access-Server	Brute-Force Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇺🇸 TPI-Abuse	2025-11-24 06:52:10 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:52:02.239646 2025] [security2:error] [pid 14814:tid 14814] [client 65.111.7.64:14015] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.austinbiblestudents.org"] [uri "/.svn/wc.db"] [unique_id "aSQAkvhEc7CgAVGR9mRyzwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:14:29 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:14:14.517634 2025] [security2:error] [pid 15794:tid 15796] [client 65.111.7.64:17047] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.g3-contracting.com"] [uri "/.env"] [unique_id "aSPblk33WdBY9AO05A3xlQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-15 22:49:56 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210730) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 17:49:49.274002 2025] [security2:error] [pid 9451:tid 9451] [client 65.111.7.64:36873] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.michaelcarrollgreen.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.michaelcarrollgreen.com"] [uri "/s3cmd.ini"] [unique_id "aRkDjfC89W_T7OPVnHyZZQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-14 17:51:00 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 65.111.7.64 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 14 12:50:56.166928 2025] [security2:error] [pid 23878:tid 23878] [client 65.111.7.64:34469] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.whysong.net"] [uri "/.env"] [unique_id "aRdsAJoQsz9ZW0-ilPhmuQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 D3monite	2025-10-27 05:52:06 (7 months ago)	Attempted Brute Force (cpaneld)	Brute-Force
Anonymous	2025-10-16 17:58:29 (7 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇺🇸 nowyouknow	2025-10-12 08:04:41 (7 months ago)	(From [email protected]) No backlinks. No waiting. Just #1 on Google in minutes: https://www.y ... show more (From [email protected]) No backlinks. No waiting. Just #1 on Google in minutes: https://www.youtube.com/watch?v=ut65EZBjArc show less	Phishing Web Spam
Anonymous	2025-10-06 11:25:00 (8 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.06 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.06 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-04 05:43:03 (8 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.04 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.04 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 217.160.3.46

🇯🇵 203.25.124.82

🇵🇪 190.233.176.164

🇬🇧 35.203.210.89

🇲🇦 197.145.208.9

🇺🇸 147.185.132.245

🇺🇸 132.196.49.109

🇨🇳 112.27.129.78

🇭🇰 103.243.24.124

🇳🇱 77.83.39.55

🇺🇸 23.98.142.186

🇺🇸 20.163.33.23

🇨🇳 14.103.115.141

🇮🇪 3.250.233.126

🇫🇷 161.97.86.82

🇺🇸 134.195.88.93

🇨🇳 120.230.232.22

🇮🇳 110.172.147.190

🇻🇳 103.48.192.48

🇺🇸 71.201.235.233