JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.40.172

104.207.40.172 was found in our database!

This IP was reported 127 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.40.172

Whois 104.207.40.172

IP Abuse Reports for 104.207.40.172:

This IP address has been reported a total of 127 times from 15 distinct sources. 104.207.40.172 was first reported on June 11th 2024, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 masterguru	2026-03-27 02:17:28 (2 months ago)	Restricted File Access Attempt. Matched phrase "/.env" at REQUEST_FILENAME. (930130-122)	Hacking Web App Attack
🇪🇸 librebit	2026-03-25 10:25:40 (2 months ago)	Brute force	Brute-Force
🇪🇸 librebit	2026-03-16 09:30:27 (2 months ago)	Brute force	Brute-Force
Anonymous	2026-02-11 09:01:00 (3 months ago)	SMS pumping	DDoS Attack VPN IP Bad Web Bot Web App Attack
🇺🇸 nowyouknow	2026-01-06 00:22:59 (5 months ago)	(From [email protected]) Hi, it’s Jayrn. If your site already uses — or is preparing ... show more (From [email protected]) Hi, it’s Jayrn. If your site already uses — or is preparing to use — affiliate links, this will be relevant. One issue I see constantly is that monetization is treated as something you “add later,” instead of something that’s designed into the site from the beginning. That usually leads to: random placement of links unclear visitor intent unpredictable income It works, but never consistently. I put together a short explanation of why this happens and what changes once monetization is structured properly: https://marketersmentor.com/recurring-income-system.php?refer=chiroresults.com You’ll know quickly whether this applies to your situation. Jayrn PS: And one quick note so you’re not wondering why you’re hearing from me: I only reach out to website owners because they’re the ones actively building something online. I’m not blasting random emails. I’m simply sharing a resource that has been helping a lot of people create predictable onlin show less	Phishing Web Spam
Anonymous	2025-12-22 17:24:09 (5 months ago)	Attempted brute force login to web vpn 126 time(s); last attempt for 2025.12.22 is noted in report t ... show more Attempted brute force login to web vpn 126 time(s); last attempt for 2025.12.22 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-11-26 11:28:14 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:28:09.806083 2025] [security2:error] [pid 22212:tid 22212] [client 104.207.40.172:37313] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.oceansgift.com"] [uri "/.git/HEAD"] [unique_id "aSbkSaaVng0vsWQETGUW4wAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 08:24:02 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 03:23:56.369506 2025] [security2:error] [pid 13750:tid 13750] [client 104.207.40.172:27841] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "buenasfrecuencias.circulodesonido.org"] [uri "/.env"] [unique_id "aSa5HPjTA1mvmTXdk3_rgAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 06:02:18 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 01:02:13.285791 2025] [security2:error] [pid 30018:tid 30018] [client 104.207.40.172:20733] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "proyectos.gabosoftware.com"] [uri "/.svn/wc.db"] [unique_id "aSaX5XoijhnSstJ8ziybQwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 02:29:36 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 21:29:31.545915 2025] [security2:error] [pid 4188:tid 4188] [client 104.207.40.172:35293] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.opticasprisma.com"] [uri "/.git/HEAD"] [unique_id "aSZmC4hqz9NYkouocIuBzwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 08:46:12 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.40.172 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:46:04.139214 2025] [security2:error] [pid 7849:tid 7849] [client 104.207.40.172:24551] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.podbillspec.com"] [uri "/.svn/wc.db"] [unique_id "aSQbTILqHVrMDzDfJKnp8AAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-09 12:33:25 (6 months ago)	Web App Attack	Brute-Force Exploited Host Web App Attack
Anonymous	2025-10-16 11:10:36 (7 months ago)	WordPress Brute Force	Brute-Force
🇨🇦 wil.com	2025-10-14 09:30:25 (7 months ago)	GlobalProtect login attempts with user stgreer.	VPN IP Brute-Force
Anonymous	2025-10-07 21:22:03 (7 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.07 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.07 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 127 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇰 220.247.224.226

🇪🇪 196.196.253.20

🇫🇮 147.185.133.234

🇲🇾 47.250.129.236

🇧🇷 45.194.67.2

🇮🇹 5.89.75.194

🇺🇸 3.141.18.243

🇳🇱 194.26.192.44

🇩🇪 185.242.3.226

🇨🇳 112.94.190.141

🇫🇷 51.75.122.142

🇺🇸 38.248.95.248

🇨🇳 27.222.44.82

🇻🇳 27.79.1.84

🇸🇬 2404:6800:4003:c20::128

🇳🇱 194.26.192.205

🇳🇱 194.26.192.20

🇬🇧 193.163.125.83

🇧🇷 191.210.73.33

🇭🇰 152.32.135.81