JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.41.121

104.207.41.121 was found in our database!

This IP was reported 140 times. Confidence of Abuse is 3%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.41.121

Whois 104.207.41.121

IP Abuse Reports for 104.207.41.121:

This IP address has been reported a total of 140 times from 17 distinct sources. 104.207.41.121 was first reported on June 4th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 sefinek.net	2026-06-06 05:51:53 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /wp-json/gravitysmtp/v1/tests/mock-data \| UA: curl/8.7.1 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇵🇱 sefinek.net	2026-04-02 15:22:21 (2 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (G ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (GET) \| Endpoint: / \| UA: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇮🇹 VHosting	2026-02-18 22:11:33 (3 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇵🇱 nfsec.pl	2026-01-22 03:50:12 (4 months ago)	104.207.41.121 - - [22/Jan/2026:03:50:03 +0000] "GET /index.php?option=com_search&searchword=%20atak ... show more 104.207.41.121 - - [22/Jan/2026:03:50:03 +0000] "GET /index.php?option=com_search&searchword=%20atak&searchphrase=exact%29%3BCALL%20REGEXP_SUBSTRING%28REPEAT%28RIGHT%28CHAR%281753%29%2C0%29%2C500000000%29%2CNULL%29--%20ASuT&ordering=newest HTTP/1.1" 403 5842 "-" "Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" 104.207.41.121 - - [22/Jan/2026:03:50:05 +0000] "GET /index.php?option=com_search&searchword=%20atak&searchphrase=exact%29%3BCALL%20REGEXP_SUBSTRING%28REPEAT%28RIGHT%28CHAR%281753%29%2C0%29%2C500000000%29%2CNULL%29%20AND%20%285762%3D5762&ordering=newest HTTP/1.1" 403 5842 "-" "Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36" 104.207.41.121 - - [22/Jan/2026:03:50:07 +0000] "GET /index.php?option=com_search&searchword=%20atak&searchphrase=exact%29%29%3BCALL%20REGEXP_SUBSTRING%28REPEAT%28RIGHT%28CHAR%281753%29%2C0%29%2C500000000%29%2CNULL%29%20AND%20%28% ... show less	Exploited Host Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:02:01 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-11-24 05:18:37 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.121 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:18:29.533503 2025] [security2:error] [pid 9494:tid 9494] [client 104.207.41.121:47919] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.arts4health.org"] [uri "/.svn/wc.db"] [unique_id "aSPqpQc_5SvTpSTNrwyVLQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-10-31 20:26:47 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.41.121 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.207.41.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 31 16:26:43.709517 2025] [security2:error] [pid 29821:tid 29821] [client 104.207.41.121:20929] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|alsetsystems.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "alsetsystems.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQUbg1eCmozdLDhPqCw6GwAAABk"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-29 02:22:21 (7 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-10-19 17:35:25 (7 months ago)	Attempted brute force login to web vpn 90 time(s); last attempt for 2025.10.19 is noted in report ti ... show more Attempted brute force login to web vpn 90 time(s); last attempt for 2025.10.19 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-18 18:29:01 (7 months ago)	Attempted brute force login to web vpn 18 time(s); last attempt for 2025.10.18 is noted in report ti ... show more Attempted brute force login to web vpn 18 time(s); last attempt for 2025.10.18 is noted in report timestamp show less	Hacking Brute-Force
🇨🇦 wil.com	2025-10-18 07:41:20 (7 months ago)	GlobalProtect login attempts with user langmayerk.	VPN IP Brute-Force
🇩🇪 bsoft.de	2025-10-16 06:43:35 (8 months ago)	104.207.41.121 - - [16/Oct/2025:08:43:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 ... show more 104.207.41.121 - - [16/Oct/2025:08:43:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13F69 Safari/601.1" 104.207.41.121 - - [16/Oct/2025:08:43:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Linux; Android 7.0; Moto C Plus Build/NRD90M.04.026) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36" 104.207.41.121 - - [16/Oct/2025:08:43:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 426 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36" show less	Web App Attack
Anonymous	2025-10-04 04:44:48 (8 months ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.04 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.04 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-02 00:17:22 (8 months ago)	Attempted brute force login to web vpn 54 time(s); last attempt for 2025.10.02 is noted in report ti ... show more Attempted brute force login to web vpn 54 time(s); last attempt for 2025.10.02 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 140 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.198.224.5

🇦🇪 5.31.239.177

🇬🇧 193.32.209.238

🇧🇷 191.240.99.67

🇵🇰 182.184.222.61

🇩🇪 167.172.97.160

🇺🇸 162.216.150.41

🇩🇪 159.195.23.229

🇮🇳 152.59.8.104

🇹🇼 123.58.196.28

🇮🇳 122.177.247.35

🇮🇳 98.70.50.166

🇺🇿 84.54.71.22

🇬🇧 35.203.210.22

🇷🇴 2.57.122.238

🇮🇳 2401:4900:b301:d6b3:d0b6:512d:767f:2a39

🇷🇺 178.216.165.187

🇺🇸 159.65.223.222

🇧🇬 149.62.239.4

🇨🇳 139.170.73.85