JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.41.16

104.207.41.16 was found in our database!

This IP was reported 107 times. Confidence of Abuse is 42%: ?

42%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.41.16

Whois 104.207.41.16

IP Abuse Reports for 104.207.41.16:

This IP address has been reported a total of 107 times from 25 distinct sources. 104.207.41.16 was first reported on June 22nd 2024, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 lostswordfish.com	2026-06-13 08:14:06 (14 hours ago)	Wordfence waf block on parsol	Web App Attack
🇫🇷 ELYAZ	2026-06-12 15:02:52 (1 day ago)	(y4) Failed scan -byebye- from 104.207.41.16 (US/United States/-): (CF_ENABLE)	Hacking
🇬🇷 setupgr	2026-06-12 14:31:33 (1 day ago)	(mod_security) mod_security (id:900001) triggered by 104.207.41.16: 1 in the last 86400 secs; Ports: ... show more (mod_security) mod_security (id:900001) triggered by 104.207.41.16: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Jun 12 17:31:30.110114 2026] [security2:error] [pid 326864:tid 326899] [client 104.207.41.16:50301] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|alloweddomain2\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "74"] [id "900001"] [msg "Blocked WP Login attempt on domain: mail.doityourself.gr"] [severity "CRITICAL"] [tag "security"] [hostname "mail.doityourself.gr"] [uri "/wp-login.php"] [unique_id "aiwYQsuFnDrX8qeXldOAkAAAAMg"], referer: https://mail.doityourself.gr/wp-login.php show less	Port Scan
🇲🇹 Malta	2026-06-11 22:54:56 (1 day ago)	104.207.41.16 - - [12/Jun/2026:00:54:56 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubun ... show more 104.207.41.16 - - [12/Jun/2026:00:54:56 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇮🇩 zam	2026-06-11 20:07:09 (2 days ago)	104.207.41.16 - - [11/Jun/2026:20:06:43 +0000] "POST /wp-login.php HTTP/1.1" 301 277	Web App Attack
🇫🇷 ELYAZ	2026-06-10 16:00:24 (3 days ago)	(y4) Failed scan -byebye- from 104.207.41.16 (US/United States/-): (CF_ENABLE)	Hacking
🇬🇧 PeravixGroup	2026-06-09 19:29:39 (4 days ago)	Honeypot detection: Apache CouchDB unauthorized access / exploitation attempt on port 5984. Severity ... show more Honeypot detection: Apache CouchDB unauthorized access / exploitation attempt on port 5984. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇺🇸 Epimetheus	2026-05-30 15:17:05 (2 weeks ago)	Unauthorized access attempts: [GET] /sitemap.xml.gz UA: Mozilla/5.0	Web App Attack
🇮🇹 VHosting	2025-12-23 16:20:31 (5 months ago)	Detected attack and reported by a human	DDoS Attack Brute-Force Bad Web Bot Exploited Host Web App Attack SSH
🇺🇸 nowyouknow	2025-12-12 21:01:58 (6 months ago)	(From [email protected]) Forget complex side hustles. The Writing Wizard system gives you th ... show more (From [email protected]) Forget complex side hustles. The Writing Wizard system gives you the simple templates to earn consistent income from home just by writing short, 3-sentence letters. No experience needed, no selling—just easy money at your own pace. Click to Learn the Secret & Start Earning! https://themoneyfromhome.com show less	Phishing Web Spam
🇺🇸 nowyouknow	2025-12-11 03:17:30 (6 months ago)	(From [email protected]) Forget complex side hustles. The Writing Wizard system gives you ... show more (From [email protected]) Forget complex side hustles. The Writing Wizard system gives you the simple templates to earn consistent income from home just by writing short, 3-sentence letters. No experience needed, no selling—just easy money at your own pace. Click to Learn the Secret & Start Earning! https://themoneyfromhome.com show less	Phishing Web Spam
🇺🇸 nowyouknow	2025-12-09 19:55:55 (6 months ago)	(From [email protected]) Forget complex side hustles. The Writing Wizard system gives you th ... show more (From [email protected]) Forget complex side hustles. The Writing Wizard system gives you the simple templates to earn consistent income from home just by writing short, 3-sentence letters. No experience needed, no selling—just easy money at your own pace. Click to Learn the Secret & Start Earning! https://themoneyfromhome.com show less	Phishing Web Spam
🇺🇸 TPI-Abuse	2025-11-25 05:07:41 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.16 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:07:32.541026 2025] [security2:error] [pid 9571:tid 9571] [client 104.207.41.16:58019] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.the-board-shop.com"] [uri "/.svn/wc.db"] [unique_id "aSU5lA2bPud3ommprDCjBAAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:47:49 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.16 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:47:42.504839 2025] [security2:error] [pid 14823:tid 14823] [client 104.207.41.16:11649] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.husman.es"] [uri "/.env"] [unique_id "aSUm3suczgg4lKXlfZ1e5QAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:26:16 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.41.16 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.41.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:26:08.265534 2025] [security2:error] [pid 16657:tid 16657] [client 104.207.41.16:57253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.dcwenger.com"] [uri "/.env"] [unique_id "aSUh0KrKCkOQtxHKA2ve7AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 107 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.190.200

🇳🇱 91.92.40.12

🇭🇰 8.217.99.120

🇧🇷 205.210.31.145

🇨🇳 182.45.41.75

🇮🇩 182.1.135.255

🇮🇳 103.190.7.203

🇮🇳 40.81.224.200

🇪🇸 212.30.33.145

🇲🇽 189.147.19.238

🇫🇷 185.177.72.12

🇳🇱 176.65.131.192

🇳🇱 160.119.69.14

🇨🇳 115.201.194.197

🇺🇸 113.20.4.9

🇳🇱 91.92.40.7

🇪🇪 46.36.220.220

🇭🇰 18.163.129.44

🇮🇩 210.79.191.76

🇳🇱 185.236.20.195