JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.41.127

104.207.41.127 was found in our database!

This IP was reported 151 times. Confidence of Abuse is 13%: ?

13%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.41.127

Whois 104.207.41.127

IP Abuse Reports for 104.207.41.127:

This IP address has been reported a total of 151 times from 19 distinct sources. 104.207.41.127 was first reported on June 6th 2024, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 PeravixGroup	2026-05-22 11:33:58 (4 weeks ago)	Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: ME ... show more Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇫🇷 geot	2026-05-13 11:41:23 (1 month ago)	GET http://<<removed>>.com/.git/HEAD HTTP/1.1	Port Scan Hacking Web App Attack
🇳🇱 homeshowdomain.nl	2026-05-12 22:02:32 (1 month ago)	Auto-ban: >3000 req/min op 2026-05-12	Web App Attack SSH Hacking
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇨🇳 ThreatBook.io	2026-01-14 22:42:14 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2026-01-14 22:40:19 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%201%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 2026-01-14 22:40:17 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%200%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-25 22:31:46 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2025-12-25 04:57:02 /video/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-24 22:35:17 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2025-12-24 04:55:12 /photo/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-18 22:36:34 (6 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2025-12-18 19:46:21 /down/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) 2025-12-18 23:44:26 /news/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-17 22:29:14 (6 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.41.127 2025-12-17 13:06:02 /prod-api/v2/api-docs 2025-12-17 13:06:03 /v2/api-docs 2025-12-17 13:06:05 /v3/api-docs 2025-12-17 02:51:03 /photo/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) 2025-12-17 13:06:04 /api/swagger.json 2025-12-17 13:06:04 /swagger/docs/v1 2025-12-17 13:06:03 /swagger/v1/swagger.json show less	Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 07:11:40 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:11:31.775658 2025] [security2:error] [pid 5297:tid 5297] [client 104.207.41.127:37485] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.meganmurph.com"] [uri "/.env"] [unique_id "aSVWo4rBR5TIPgR4GGaKjQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 SilverZippo	2025-11-25 01:48:37 (6 months ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 09:17:11 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:17:03.095904 2025] [security2:error] [pid 10593:tid 10593] [client 104.207.41.127:49387] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dividivipartners.com"] [uri "/.env"] [unique_id "aSQijx5aiDCQ5lXOFLPlJgAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 08:11:40 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:11:37.425973 2025] [security2:error] [pid 16851:tid 16851] [client 104.207.41.127:43815] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.gpahomeinspections.com"] [uri "/.git/HEAD"] [unique_id "aSQTOZQEE6y7c5UMkaTDFwAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:13:04 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:12:57.558487 2025] [security2:error] [pid 12103:tid 12145] [client 104.207.41.127:57103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.promc.xyz"] [uri "/.svn/wc.db"] [unique_id "aSQFeed3pxroRSWDTtpg4QAAAMw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:29:17 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.127 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:29:14.689206 2025] [security2:error] [pid 13985:tid 13985] [client 104.207.41.127:60403] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ralserve.net"] [uri "/.git/HEAD"] [unique_id "aSPtKsIiEpmAHqhPvpVYDAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 151 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.152

🇺🇸 20.65.194.88

🇮🇳 182.18.161.165

🇹🇭 110.164.193.196

🇿🇦 102.131.22.199

🇺🇸 50.89.10.4

🇮🇳 182.95.181.50

🇧🇬 162.158.210.246

🇫🇷 158.220.111.161

🇺🇸 35.193.1.39

🇨🇭 31.7.59.178

🇺🇸 20.171.26.41

🇺🇸 18.190.15.50

🇳🇱 5.255.104.228

🇬🇧 193.163.125.121

🇦🇺 170.64.167.72

🇺🇸 165.154.172.68

🇵🇰 160.187.180.175

🇷🇺 91.78.228.51

🇺🇸 40.77.167.255