JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.37.9

104.207.37.9 was found in our database!

This IP was reported 139 times. Confidence of Abuse is 15%: ?

15%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.37.9

Whois 104.207.37.9

IP Abuse Reports for 104.207.37.9:

This IP address has been reported a total of 139 times from 30 distinct sources. 104.207.37.9 was first reported on June 3rd 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 PeravixGroup	2026-05-23 01:27:20 (1 week ago)	Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: ME ... show more Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇬🇧 PeravixGroup	2026-05-22 11:39:00 (2 weeks ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇨🇳 ThreatBook.io	2026-05-10 23:51:19 (3 weeks ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 202 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 2026-05-10 18:55:24 /docs/appdev/sample/web/WEB-INF/web.xml show less	Web App Attack
Anonymous	2026-04-18 10:02:40 (1 month ago)	Forum/form spam	Web Spam
🇨🇳 ThreatBook.io	2026-04-17 23:38:48 (1 month ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 202 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 2026-04-17 01:49:30 /druid/index.html show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-16 23:27:36 (1 month ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 202 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 2026-04-16 07:34:18 /down/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-03 23:43:45 (2 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 202 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 2026-04-03 05:09:34 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%200%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 2026-04-03 05:09:34 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%201%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-02 23:57:23 (2 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 202 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.37.9 2026-04-02 23:21:55 /news/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
Anonymous	2026-03-17 18:46:48 (2 months ago)	Forum/form spam	Web Spam
🇳🇱 jjnxpct	2026-02-14 04:52:50 (3 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.env (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .env found within REQUEST_FILENAME: /.env] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 06:21:41 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 01:21:38.753938 2026] [security2:error] [pid 2406237:tid 2406237] [client 104.207.37.9:23121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kozzmik.online"] [uri "/.git/config"] [unique_id "aY7C8ucZ-k54EhTg_J5fGgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-02-13 06:08:19 (3 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.37.9 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.37.9 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 05:04:38 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 00:04:31.266199 2026] [security2:error] [pid 18454:tid 18454] [client 104.207.37.9:54225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kln.ne.jp"] [uri "/.git/config"] [unique_id "aY6w38YZjEe_WAgJ-rGeHQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 04:00:30 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 23:00:25.529514 2026] [security2:error] [pid 951:tid 951] [client 104.207.37.9:9609] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kindred-vitality.com"] [uri "/.env.staging"] [unique_id "aY6h2WztN28g2BmLzBZdBgAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 02:59:58 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.37.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 21:59:50.332269 2026] [security2:error] [pid 16356:tid 16356] [client 104.207.37.9:21355] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kevinfranz.com"] [uri "/new/.git/config"] [unique_id "aY6TppTkME91k2CyNHWzNAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 139 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.102

🇹🇼 198.235.24.101

🇨🇳 182.116.49.38

🇷🇺 176.109.97.11

🇺🇸 172.217.29.138

🇨🇩 102.216.240.61

🇸🇬 101.47.156.21

🇩🇪 64.89.163.250

🇻🇳 14.225.173.146

🇲🇾 203.121.40.210

🇪🇹 196.189.91.218

🇲🇦 196.119.12.127

🇻🇳 103.159.54.61

🇨🇳 60.12.106.119

🇷🇴 2.57.121.25

🇩🇪 2.27.20.28

🇳🇱 185.242.226.18

🇯🇵 103.27.132.56

🇯🇴 86.108.18.141

🇷🇴 80.94.92.165