JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.38.141

104.207.38.141 was found in our database!

This IP was reported 130 times. Confidence of Abuse is 39%: ?

39%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.38.141

Whois 104.207.38.141

IP Abuse Reports for 104.207.38.141:

This IP address has been reported a total of 130 times from 21 distinct sources. 104.207.38.141 was first reported on June 11th 2024, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇷 setupgr	2026-06-17 18:43:08 (1 hour ago)	(mod_security) mod_security (id:900001) triggered by 104.207.38.141 (US/United States/Virginia/Ashbu ... show more (mod_security) mod_security (id:900001) triggered by 104.207.38.141 (US/United States/Virginia/Ashburn/-/[AS200373 DREI-K-TECH-GMBH]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Jun 17 21:43:05.145614 2026] [security2:error] [pid 2210295:tid 2210423] [client 104.207.38.141:64065] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|sea-sound\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "75"] [id "900001"] [msg "Blocked WP Login attempt on domain: cpanagiotou.gr"] [severity "CRITICAL"] [tag "security"] [hostname "cpanagiotou.gr"] [uri "/wp-login.php"] [unique_id "ajLquYHi3fYqxwKQHNaM9gAAAcg"], referer: https://cpanagiotou.gr/wp-login.php show less	Port Scan
🇫🇷 ELYAZ	2026-06-17 02:39:44 (17 hours ago)	(y4) Failed scan -byebye- from 104.207.38.141 (US/United States/-): (CF_ENABLE)	Hacking
🇨🇭 4server	2026-06-16 12:59:38 (1 day ago)	[TueJun1614:59:33.5979732026][security2:error][pid40518:tid40771][client104.207.38.141:0]ModSecurity ... show more [TueJun1614:59:33.5979732026][security2:error][pid40518:tid40771][client104.207.38.141:0]ModSecurity:Accessdeniedwithcode403$phase2$.OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded$TotalScore:5$\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"annunci-ticino.ch\"][uri\"/wp-login.php\"][unique_id\"ajFItSexEmd4MXiqqj5d4gAAAQ0\"]\,referer:https://annunci-ticino.ch/wp-login.php show less	Hacking Web App Attack
🇩🇪 F242	2026-06-14 19:08:54 (3 days ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇨🇿 huginet	2026-06-12 01:28:11 (5 days ago)	104.207.38.141 - - [12/Jun/2026:03:27:35 +0200] "POST /xmlrpc.php HTTP/1.1" 503 19591 "-" "Mozilla/5 ... show more 104.207.38.141 - - [12/Jun/2026:03:27:35 +0200] "POST /xmlrpc.php HTTP/1.1" 503 19591 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15" 104.207.38.141 - - [12/Jun/2026:03:28:11 +0200] "POST /xmlrpc.php HTTP/1.1" 503 18658 "https://www.bing.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" ... show less	Web Spam Blog Spam Hacking Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-06-10 07:52:06 (1 week ago)	Wordfence waf block on kcuar	Web App Attack
🇫🇮 inlink.ltd	2026-05-25 22:22:30 (3 weeks ago)	Known malicious PHP file or CMS probe	Web App Attack
🇮🇹 VHosting	2026-02-18 22:11:36 (3 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇺🇸 fbarela	2026-01-25 04:01:19 (4 months ago)	FortiGate SSL VPN login failures.	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-12-10 14:52:11 (6 months ago)	"Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized ac ... show more "Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized access" show less	DDoS Attack SQL Injection Exploited Host
🇺🇸 TPI-Abuse	2025-11-25 07:28:27 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.141 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:28:21.352144 2025] [security2:error] [pid 10266:tid 10266] [client 104.207.38.141:13797] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fetchamreadingroom.org"] [uri "/.svn/wc.db"] [unique_id "aSValUoFFGoyY9GDUYc1KgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 06:53:33 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.141 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:53:26.961066 2025] [security2:error] [pid 18092:tid 18092] [client 104.207.38.141:23417] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyclingboardgames.net.ankitoner.com"] [uri "/.svn/wc.db"] [unique_id "aSVSZuk0-02Bzm9aOahmRgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:55:38 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.141 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.141 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:55:30.406575 2025] [security2:error] [pid 8428:tid 8428] [client 104.207.38.141:48811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davidfiss.com"] [uri "/.env"] [unique_id "aSUaouUdtBitPpqw0p73WAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nowyouknow	2025-11-16 20:23:17 (7 months ago)	(From [email protected]) Hi, Keeping your website current, secure, and professional can ... show more (From [email protected]) Hi, Keeping your website current, secure, and professional can be time-consuming. That’s why we offer a done-for-you solution: For $69/month, we will: Create or refresh your entire website Host it (Optional - If you want) Update it with 60 minutes of included updates each month No hidden fees, no headaches—just a professional website that always looks great and works smoothly. Learn More https://websolutionsgenius.com/complete-website-package/ show less	Phishing Web Spam
🇨🇦 wil.com	2025-10-15 20:59:17 (8 months ago)	GlobalProtect login attempts with user kyperry.	VPN IP Brute-Force

Showing 1 to 15 of 130 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 103.143.10.79

🇻🇳 103.1.210.25

🇷🇴 80.94.92.164

🇧🇪 198.235.24.202

🇮🇳 122.168.194.41

🇫🇷 91.231.89.1

🇩🇪 69.5.169.218

🇭🇰 45.249.246.196

🇬🇧 135.136.20.20

🇧🇬 78.128.112.215

🇩🇪 64.89.163.173

🇱🇹 45.227.254.170

🇺🇸 20.65.195.32

🇺🇸 20.14.73.198

🇸🇬 8.219.109.151

🇺🇸 2605:a140:2282:1414::1

🇩🇪 194.88.98.112

🇮🇳 154.221.35.72

🇨🇳 113.96.35.187

🇺🇸 20.9.34.144