JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.38.206

104.207.38.206 was found in our database!

This IP was reported 132 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.38.206

Whois 104.207.38.206

IP Abuse Reports for 104.207.38.206:

This IP address has been reported a total of 132 times from 15 distinct sources. 104.207.38.206 was first reported on June 11th 2024, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇺🇸 TPI-Abuse	2026-02-20 12:11:27 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 20 07:11:22.686096 2026] [security2:error] [pid 23272:tid 23272] [client 104.207.38.206:60291] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|rcjav.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rcjav.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZhPasZmOuieMjK8mEYC2gAAAAY"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 10dencehispahard SL	2026-01-26 07:27:16 (4 months ago)	Wordpress probing for vulnerabilities	Hacking Exploited Host
🇱🇻 garmtech.com	2026-01-12 10:16:42 (5 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 12-16.104.207.38.206.web-spamm ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 12-16.104.207.38.206.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 19:37:44 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 14:37:39.859294 2025] [security2:error] [pid 8599:tid 8599] [client 104.207.38.206:17517] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arriagarealestate.com"] [uri "/.git/HEAD"] [unique_id "aS9AA2kbXxj7bq5QUnlzPAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 14:07:35 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 09:07:25.997213 2025] [security2:error] [pid 13096:tid 13096] [client 104.207.38.206:57799] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tandemfamilycoaching.com"] [uri "/.env"] [unique_id "aS7ync92fP7R-u5CjYpk_gAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 05:35:18 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 00:35:12.410185 2025] [security2:error] [pid 13152:tid 13152] [client 104.207.38.206:55231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myvdi.com"] [uri "/.git/HEAD"] [unique_id "aS56kBU3gLaVhpacIFTz7wAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 05:17:14 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 00:17:11.582565 2025] [security2:error] [pid 458:tid 458] [client 104.207.38.206:34539] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kugbe.com"] [uri "/.svn/wc.db"] [unique_id "aS52V5RRXP9wQpAFOpGvEQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 myagent.site	2025-12-02 01:21:05 (6 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇺🇸 TPI-Abuse	2025-11-27 21:17:01 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:16:53.495305 2025] [security2:error] [pid 15273:tid 15273] [client 104.207.38.206:34619] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "edgecomix.com"] [uri "/.env"] [unique_id "aSi_xWAJpJYESZuxMHyOigAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Holger	2025-11-25 07:52:33 (6 months ago)	Bruteforce WebAttack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 07:32:24 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:32:16.650491 2025] [security2:error] [pid 15804:tid 15804] [client 104.207.38.206:33177] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.dipseanet.com"] [uri "/.git/HEAD"] [unique_id "aSVbgD1xREJE_llNIv-NpAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 07:06:34 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.206 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:06:21.487254 2025] [security2:error] [pid 20000:tid 20000] [client 104.207.38.206:34239] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.l3l4.kleens-uk.com"] [uri "/.env"] [unique_id "aSVVbTVWyxbUSRtur05wOwAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-14 01:18:52 (7 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-10-29 05:12:16 (7 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack

Showing 1 to 15 of 132 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 192.81.217.104

🇪🇨 181.119.184.119

🇺🇸 162.216.150.156

🇩🇪 104.248.131.237

🇻🇳 103.63.108.25

🇳🇱 89.248.167.131

🇻🇪 38.41.4.192

🇮🇳 182.78.151.234

🇫🇮 147.185.133.180

🇸🇦 130.164.149.242

🇻🇳 113.190.51.175

🇳🇱 45.148.10.240

🇺🇸 181.215.65.3

🇭🇰 165.154.225.7

🇮🇩 114.10.147.136

🇻🇳 113.184.7.129

🇺🇸 103.143.231.24

🇱🇹 81.30.98.44

🇻🇪 38.17.173.40

🇺🇦 31.128.191.144