JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.38.228

104.207.38.228 was found in our database!

This IP was reported 157 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.38.228

Whois 104.207.38.228

IP Abuse Reports for 104.207.38.228:

This IP address has been reported a total of 157 times from 20 distinct sources. 104.207.38.228 was first reported on June 11th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 [email protected]	2026-05-25 20:32:29 (1 month ago)	104.207.38.228 - - [25/May/2026:15:48:25 +0200] "GET /wp-login.php HTTP/1.1" 301 817 "-" "curl/8.6.0 ... show more 104.207.38.228 - - [25/May/2026:15:48:25 +0200] "GET /wp-login.php HTTP/1.1" 301 817 "-" "curl/8.6.0" show less	Brute-Force Web App Attack
🇮🇹 [email protected]	2026-05-25 13:48:27 (1 month ago)	[Mon May 25 15:48:27.439490 2026] [authz_core:error] [pid 2072863:tid 2072923] [client 104.207.38.22 ... show more [Mon May 25 15:48:27.439490 2026] [authz_core:error] [pid 2072863:tid 2072923] [client 104.207.38.228:61829] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/wp-login.php, referer: http://wordpress.diegoweb.it/wp-login.php show less	Brute-Force Web App Attack
Anonymous	2026-04-22 15:13:55 (2 months ago)	Attempt to scan vulnerabilities	Hacking
Anonymous	2026-04-13 23:21:48 (2 months ago)	Attempt to scan vulnerabilities	Hacking
🇩🇪 kjaerulff	2026-03-17 15:57:57 (3 months ago)	Failed Wordpress login using wp-login.php	Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 08:49:23 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 03:49:15.057333 2025] [security2:error] [pid 28875:tid 28875] [client 104.207.38.228:15649] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "elissazeches.com"] [uri "/.env"] [unique_id "aVJAi6r55Atcqjiol0GCSAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 08:19:17 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 03:19:13.496332 2025] [security2:error] [pid 11476:tid 11476] [client 104.207.38.228:14877] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scpublicity.com"] [uri "/.env"] [unique_id "aVI5gTG-0pW1hJmatqZx_QAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 04:13:37 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 23:13:31.427036 2025] [security2:error] [pid 28498:tid 28498] [client 104.207.38.228:12253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trafficstopper.com"] [uri "/.svn/wc.db"] [unique_id "aVH_6_ByxzHEIk-X-v6tiAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 fbarela	2025-12-28 22:00:14 (6 months ago)	FortiGate SSL VPN login failures.	Hacking Brute-Force
🇫🇷 mrcrassi	2025-12-17 14:26:51 (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST meth ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2025-12-05 10:39:59 (6 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 05:39:55.193574 2025] [security2:error] [pid 21382:tid 21382] [client 104.207.38.228:25319] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jolankagroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTK2e_bE_DHvsMltjmR02QAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 22:07:06 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.38.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 17:07:01.680783 2025] [security2:error] [pid 665401:tid 665401] [client 104.207.38.228:46089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "harvestfrc.com"] [uri "/.svn/wc.db"] [unique_id "aSjLhQ0RYYJ7ND9hKjiWhwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 Shaik Sai Meera	2025-11-27 20:30:11 (7 months ago)	IM360 WAF: Hidden file access	Brute-Force
Anonymous	2025-11-14 09:56:39 (7 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-10-18 02:36:15 (8 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.18 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.18 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 157 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a03:ee40:1011:3:be24:11ff:fe78:dc

🇨🇳 171.37.46.144

🇺🇸 104.248.229.49

🇷🇴 92.118.39.14

🇲🇽 46.250.163.163

🇺🇸 45.146.55.99

🇮🇳 2404:6800:4000:1006::129

🇧🇷 205.164.176.149

🇻🇳 165.154.221.175

🇸🇬 143.198.85.89

🇳🇱 91.92.40.237

🇸🇬 84.75.150.50

🇱🇹 81.30.98.26

🇺🇸 69.171.231.130

🇺🇸 51.81.22.88

🇳🇱 91.92.40.4

🇻🇳 14.225.7.70

🇺🇸 2607:f8b0:400e:c17::125

🇮🇳 2404:6800:4000:1006::122

🇩🇪 185.216.214.42