JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.36.149

104.207.36.149 was found in our database!

This IP was reported 128 times. Confidence of Abuse is 19%: ?

19%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.36.149

Whois 104.207.36.149

IP Abuse Reports for 104.207.36.149:

This IP address has been reported a total of 128 times from 15 distinct sources. 104.207.36.149 was first reported on June 13th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-06-23 03:50:35 (1 day ago)	Web App Attack	Web App Attack
🇨🇭 4server	2026-05-20 07:48:03 (1 month ago)	[WedMay2009:47:59.3784972026][security2:error][pid1599795:tid1599806][client104.207.36.149:0]ModSecu ... show more [WedMay2009:47:59.3784972026][security2:error][pid1599795:tid1599806][client104.207.36.149:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.eutecne.ch\"][uri\"/\"][unique_id\"ag1nLyMjovcdLC4SXVDRqAAAAEQ\"] show less	Hacking Web App Attack
🇺🇸 mw	2026-05-04 00:00:29 (1 month ago)	GET /.env HTTP/1.1	Web App Attack
🇬🇧 poundawebsiteltd	2026-04-28 14:09:43 (1 month ago)	Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:443 104.207.36.149 - - [28/Apr/2026: ... show more Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:443 104.207.36.149 - - [28/Apr/2026:15:09:41 +0100] GET /s3cmd.ini HTTP/1.1 403 3107 - iTunes/4.2 (Macintosh; U; PPC Mac OS X 10.2) show less	Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇺🇸 TPI-Abuse	2026-02-21 02:46:41 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.36.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.207.36.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 21:46:37.737876 2026] [security2:error] [pid 28438:tid 28438] [client 104.207.36.149:14497] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|poulsoncustomhomes.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "poulsoncustomhomes.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZkcjbY5jxAYXP4wGIaU3AAAAA0"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-20 05:45:45 (4 months ago)	Failed Wordpress login	Hacking Brute-Force Web App Attack
🇮🇪 Jim Keir	2025-12-29 06:12:10 (5 months ago)	2025-12-29 06:12:10 104.207.36.149 File scanning, blocking 104.207.36.149 for 5 minutes	Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 05:17:26 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.36.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.36.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 00:17:20.333050 2025] [security2:error] [pid 1216478:tid 1216478] [client 104.207.36.149:58231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xpengineering.com"] [uri "/.env"] [unique_id "aVIO4KjslXpfsn6vLNT7MQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 04:45:29 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.36.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.36.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 23:45:23.997721 2025] [security2:error] [pid 17159:tid 17159] [client 104.207.36.149:16515] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aandbnaturalfoods.com"] [uri "/.env"] [unique_id "aVIHY7q04UW4Cdv4cZ0zDwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-17 15:20:50 (8 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇨🇦 wil.com	2025-10-16 05:14:32 (8 months ago)	GlobalProtect login attempts with user coresolutions.	VPN IP Brute-Force
Anonymous	2025-10-11 06:04:16 (8 months ago)	Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.11 is noted in report ti ... show more Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.11 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-10 21:07:36 (8 months ago)	Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.10 is noted in report t ... show more Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.10 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-09 22:12:35 (8 months ago)	Attempted brute force login to web vpn 180 time(s); last attempt for 2025.10.09 is noted in report t ... show more Attempted brute force login to web vpn 180 time(s); last attempt for 2025.10.09 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 128 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 172.71.172.32

🇺🇸 141.11.88.101

🇺🇸 136.114.169.55

🇭🇰 43.129.193.109

🇺🇸 34.136.5.90

🇳🇱 192.142.24.7

🇺🇸 141.11.88.6

🇻🇳 123.28.70.202

🇻🇳 103.172.236.241

🇸🇬 74.114.31.148

🇺🇸 38.12.5.206

🇺🇸 23.100.85.64

🇺🇸 20.65.195.51

🇳🇱 195.178.110.26

🇧🇷 172.217.37.19

🇭🇰 162.211.181.66

🇫🇮 138.124.80.167

🇮🇩 103.160.213.137

🇸🇨 45.194.67.146

🇺🇸 34.173.130.125