JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.167.19.52

104.167.19.52 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 24%: ?

24%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.167.19.52

Whois 104.167.19.52

IP Abuse Reports for 104.167.19.52:

This IP address has been reported a total of 37 times from 18 distinct sources. 104.167.19.52 was first reported on September 26th 2025, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 drewf.ink	2026-10-12 02:23:58 (4 days ago)	[02:23] Attempted HTTPS Fortinet SSL-VPN login with credentials guest:1****#	Web App Attack
🇺🇸 drewf.ink	2026-10-11 02:09:52 (5 days ago)	[02:09] Attempted HTTPS Fortinet SSL-VPN login with credentials Guest:G****@	Web App Attack
🇪🇸 raiolanetworks.com	2026-09-21 04:40:49 (3 weeks ago)	Honeypot detection: Cisco ASA exploit attempt. 2 events observed. Reported automatically from a hone ... show more Honeypot detection: Cisco ASA exploit attempt. 2 events observed. Reported automatically from a honeypot sensor. show less	Hacking
🇺🇸 entangled_mongoose	2026-09-17 16:48:47 (4 weeks ago)	Probed /wp-login.php.	Web App Attack
🇸🇬 securejdprop	2026-09-10 23:14:04 (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET DROP Spamhaus D ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET DROP Spamhaus DROP Listed Traffic Inbound group 23). show less	Hacking Web App Attack
🇨🇭 Origon	2026-09-08 23:51:31 (1 month ago)	http-probing - IP: 104.167.19.52 - time="2026-09-09T01:51:31+02:00" level=info msg="(555f66b4f6a745 ... show more http-probing - IP: 104.167.19.52 - time="2026-09-09T01:51:31+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 104.167.19.52 (US/200373) : 4h ban on Ip 104.167.19.52" module=db show less	Web App Attack
🇺🇸 drewf.ink	2026-08-31 22:22:30 (1 month ago)	[22:22] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [22:22] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
Anonymous	2026-07-30 02:05:25 (2 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 05-05.104.167.19.52.web-spamme ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 05-05.104.167.19.52.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇩🇪 LRob	2026-06-12 02:45:12 (4 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇩🇪 LRob	2026-06-09 03:30:45 (4 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
Anonymous	2026-05-20 04:10:13 (4 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 07-10.104.167.19.52.web-spamme ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 07-10.104.167.19.52.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
Anonymous	2026-05-08 06:43:30 (5 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-43.104.167.19.52.web-spamme ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-43.104.167.19.52.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-21 14:10:34 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.167.19.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.167.19.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 21 09:10:27.488021 2026] [security2:error] [pid 1724577:tid 1724592] [client 104.167.19.52:17751] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "inal.org"] [uri "/.svn/wc.db"] [unique_id "aXDeU4ijgBTAZ2Aj_d7VfAAAAM0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-21 00:18:43 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.167.19.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.167.19.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 19:18:37.503656 2026] [security2:error] [pid 20898:tid 20898] [client 104.167.19.52:58333] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cadimpressions.com"] [uri "/.git/HEAD"] [unique_id "aXAbXUWPOas7qSO2eITpswAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-20 22:08:57 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.167.19.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.167.19.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 17:08:50.480983 2026] [security2:error] [pid 31595:tid 31595] [client 104.167.19.52:53059] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ssion.com"] [uri "/.env"] [unique_id "aW_88tqwADDSIFlOZqCNCgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.7.213.54

🇺🇸 192.253.209.54

🇮🇳 182.70.118.145

🇨🇳 180.165.63.247

🇺🇸 165.245.168.29

🇺🇸 147.185.132.169

🇮🇳 122.161.242.176

🇺🇸 107.150.105.10

🇱🇹 77.90.185.20

🇺🇸 66.94.122.104

🇺🇸 57.141.4.14

🇸🇬 45.78.204.246

🇺🇸 216.219.89.86

🇺🇸 209.85.160.170

🇻🇪 190.153.46.61

🇦🇷 186.158.3.88

🇵🇱 185.241.208.191

🇧🇷 179.102.19.29

🇵🇦 179.43.153.2

🇬🇧 172.64.192.141