JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.43.118

104.207.43.118 was found in our database!

This IP was reported 173 times. Confidence of Abuse is 32%: ?

32%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.43.118

Whois 104.207.43.118

IP Abuse Reports for 104.207.43.118:

This IP address has been reported a total of 173 times from 33 distinct sources. 104.207.43.118 was first reported on June 5th 2024, and the most recent report was 20 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇿 billyborsht	2026-06-14 17:58:05 (20 hours ago)	2026-06-15T05:58:05.206245+12:00 southern wordpress(blogs.thinktank.co.nz)[773076]: Authentication a ... show more 2026-06-15T05:58:05.206245+12:00 southern wordpress(blogs.thinktank.co.nz)[773076]: Authentication attempt for unknown user lusie.carry from 104.207.43.118 ... show less	Hacking Web App Attack
🇬🇷 setupgr	2026-06-14 12:27:46 (1 day ago)	(mod_security) mod_security (id:900001) triggered by 104.207.43.118: 1 in the last 86400 secs; Ports ... show more (mod_security) mod_security (id:900001) triggered by 104.207.43.118: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Jun 14 15:27:46.176620 2026] [security2:error] [pid 921889:tid 922063] [client 104.207.43.118:32207] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|sea-sound\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "74"] [id "900001"] [msg "Blocked WP Login attempt on domain: mail.babis.photo"] [severity "CRITICAL"] [tag "security"] [hostname "mail.babis.photo"] [uri "/wp-login.php"] [unique_id "ai6eQiykT1eM1OfD7bvwUwAAAUg"], referer: https://mail.babis.photo/wp-login.php show less	Port Scan
🇩🇪 FeG Deutschland	2026-06-14 08:16:25 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇩🇪 iNetWorker	2026-06-13 07:09:26 (2 days ago)	trolling for resource vulnerabilities	Web App Attack
🇮🇩 zam	2026-06-11 20:06:19 (3 days ago)	104.207.43.118 - - [11/Jun/2026:20:06:06 +0000] "POST /wp-login.php HTTP/1.1" 301 277	Web App Attack
🇪🇸 librebit	2026-04-01 09:51:53 (2 months ago)	Brute force	Brute-Force
Anonymous	2026-03-26 18:19:19 (2 months ago)	Forum/form spam	Web Spam
🇳🇱 jjnxpct	2026-02-14 04:52:45 (4 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /site/.git/config (Rule ID: 930130) - Restricted File Access Attempt show less	Hacking Web App Attack
🇮🇩 Burayot	2026-02-13 06:08:07 (4 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.43.118 (US/United States/-) ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.43.118 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇳🇱 jjnxpct	2026-02-13 04:48:29 (4 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.git/config (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .git/ found within REQUEST_FILENAME: /.git/config] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 04:41:15 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.43.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.43.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 23:41:12.478115 2026] [security2:error] [pid 12534:tid 12552] [client 104.207.43.118:64733] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kiwimagic.net"] [uri "/backup/.git/config"] [unique_id "aY6raDxQLiSCEGPdqgh0rwAAANA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 02:31:55 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.43.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.43.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 21:31:52.002098 2026] [security2:error] [pid 19856:tid 19856] [client 104.207.43.118:61489] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kemela.com"] [uri "/backend/.env"] [unique_id "aY6NGAiQDKgcp7975GyhNAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-13 02:02:02 (4 months ago)	Bot / scanning and/or hacking attempts: GET /admin/.git/config HTTP/1.1, GET /backup/.git/config HTT ... show more Bot / scanning and/or hacking attempts: GET /admin/.git/config HTTP/1.1, GET /backup/.git/config HTTP/1.1, GET /backend/.env HTTP/1.1, GET /api/.git/config HTTP/1.1, GET /.git/config HTTP/1.1, GET /wp/.git/config HTTP/1.1, GET /.aws/credentials HTTP/1.1, GET /app/.env HTTP/1.1, GET /config/.env HTTP/1.1, GET /.env.save HTTP/1.1, GET /admin/.env HTTP/1.1, GET /test/.git/config HTTP/1.1, GET /api/.env HTTP/1.1, GET /site/.git/config HTTP/1.1, GET /new/.git/config HTTP/1.1, GET /dev/.git/config HTTP/1.1, GET /frontend/.env HTTP/1.1, GET /.env.local HTTP/1.1, GET /v2/.git/config HTTP/1.1, GET /app/.git/config HTTP/1.1 show less	Hacking Web App Attack
🇧🇾 lns.bz	2026-02-13 02:00:56 (4 months ago)	.env scanning [BY]	Web App Attack
🇺🇸 TPI-Abuse	2026-02-13 01:57:07 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.43.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.43.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 20:57:02.533146 2026] [security2:error] [pid 19143:tid 19143] [client 104.207.43.118:38125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kbalan.com"] [uri "/.env.staging"] [unique_id "aY6E7t-KXwl12sXEyeGKWQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 173 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.176.31.217

🇫🇷 91.196.152.210

🇳🇱 81.19.216.82

🇳🇱 45.156.128.153

🇰🇿 212.154.234.9

🇷🇼 197.243.14.52

🇩🇪 193.142.43.122

🇳🇱 176.65.149.182

🇫🇷 62.169.27.195

🇷🇴 2.57.122.238

🇺🇾 186.48.143.122

🇺🇸 152.32.149.206

🇮🇷 86.57.39.125

🇳🇱 45.156.128.152

🇳🇱 45.142.193.191

🇩🇪 2400:cb00:928:1000:8af4:68dd:a7b6:30c7

🇹🇼 211.23.109.116

🇷🇴 193.46.255.86

🇰🇷 175.126.37.156

🇬🇧 87.236.176.83