JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.42.149

104.207.42.149 was found in our database!

This IP was reported 144 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.42.149

Whois 104.207.42.149

IP Abuse Reports for 104.207.42.149:

This IP address has been reported a total of 144 times from 20 distinct sources. 104.207.42.149 was first reported on June 6th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-04-22 15:37:15 (1 month ago)	Attempt to scan vulnerabilities	Hacking
Anonymous	2026-04-12 06:16:50 (1 month ago)	Attempt to scan vulnerabilities	Hacking
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:51 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇱🇻 garmtech.com	2025-11-25 06:57:05 (6 months ago)	Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.	Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:41:56 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:41:53.433848 2025] [security2:error] [pid 13358:tid 13358] [client 104.207.42.149:29829] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.poland-yacht-registration.com"] [uri "/.git/HEAD"] [unique_id "aSUzkcR8Yl2SzF9rxq1yPQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:18:59 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:18:52.185425 2025] [security2:error] [pid 31009:tid 31009] [client 104.207.42.149:22957] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.batonrougecustomcabinets.com"] [uri "/.svn/wc.db"] [unique_id "aSUgHG94ZWZGLc6Zo5DvAwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:53:57 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:53:52.543320 2025] [security2:error] [pid 24127:tid 24127] [client 104.207.42.149:39825] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sabbathschoolguide.com"] [uri "/.git/HEAD"] [unique_id "aSUaQCkKp6JHhqjAHWXmDQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 01:31:57 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:31:49.158063 2025] [security2:error] [pid 25064:tid 25064] [client 104.207.42.149:23883] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.wcsystems.net"] [uri "/.svn/wc.db"] [unique_id "aSUHBY6EFK0eVWcOjIrsWAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 01:09:24 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.42.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:09:15.227771 2025] [security2:error] [pid 829:tid 829] [client 104.207.42.149:57625] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.karendraughon.com"] [uri "/.env"] [unique_id "aSUBu2YnGQ8ShHgftAiUlwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-14 01:18:58 (6 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇧🇷 hostseries	2025-10-25 07:28:08 (7 months ago)	Trigger: LF_DISTATTACK	Brute-Force
Anonymous	2025-10-18 11:34:13 (7 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-10-17 10:24:34 (7 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.17 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.17 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-16 14:33:37 (7 months ago)	[redacted] 104.207.42.149 - - [16/Oct/2025:16:33:31 +0200] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" " ... show more [redacted] 104.207.42.149 - - [16/Oct/2025:16:33:31 +0200] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" [redacted] 104.207.42.149 - - [16/Oct/2025:16:33:32 +0200] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (Linux; Android 7.0; Moto C Build/NRD90M.063) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36" [redacted] 104.207.42.149 - - [16/Oct/2025:16:33:32 +0200] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (Linux; Android 7.0; Moto G (4) Build/NPJS25.93-14-8.1-9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36" [redacted] 104.207.42.149 - - [16/Oct/2025:16:33:33 +0200] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like M ... show less	Hacking Web App Attack

Showing 1 to 15 of 144 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.63.223.140

🇮🇩 163.7.3.26

🇧🇷 177.190.193.58

🇺🇸 172.236.96.130

🇳🇱 153.80.240.139

🇭🇰 152.32.171.99

🇩🇪 134.122.93.100

🇧🇷 129.121.32.44

🇺🇸 108.181.3.205

🇳🇱 93.123.109.128

🇬🇧 81.19.219.235

🇺🇸 66.132.186.214

🇰🇷 49.247.37.22

🇮🇹 45.9.251.196

🇺🇸 216.138.31.75

🇦🇷 201.219.95.217

🇧🇮 197.157.195.53

🇬🇧 193.163.125.182

🇺🇸 162.243.228.110

🇺🇸 162.216.149.160