JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.43.38

104.207.43.38 was found in our database!

This IP was reported 131 times. Confidence of Abuse is 17%: ?

17%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.43.38

Whois 104.207.43.38

IP Abuse Reports for 104.207.43.38:

This IP address has been reported a total of 131 times from 13 distinct sources. 104.207.43.38 was first reported on June 4th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 LSPCCU	2026-06-03 20:23:59 (2 days ago)	TSEC Honeypot Network report. Threat score: 65/100. Categories: Hacking. Honeypot: ssh-telnet, cowri ... show more TSEC Honeypot Network report. Threat score: 65/100. Categories: Hacking. Honeypot: ssh-telnet, cowrie. Context: 104. show less	Hacking
🇪🇸 librebit	2026-05-23 07:45:06 (1 week ago)	Brute force	Brute-Force
Anonymous	2026-05-01 03:49:39 (1 month ago)	Forum/form spam	Web Spam
🇺🇸 octageeks.com	2026-03-13 04:07:40 (2 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇺🇸 octageeks.com	2026-03-08 05:07:58 (2 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇺🇸 TPI-Abuse	2025-12-30 18:30:56 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.43.38 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.43.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 13:30:39.232159 2025] [security2:error] [pid 11944:tid 11944] [client 104.207.43.38:38085] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.patrickodougherty.com"] [uri "/.svn/wc.db"] [unique_id "aVQaT07lLOl0k8XRW2Rp4wAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2025-12-30 17:57:44 (5 months ago)	Blocked by UFW (TCP on 80) Source port: 39441 TTL: 52 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 39441 TTL: 52 Packet length: 60 TOS: 0x00 This report (for 104.207.43.38) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:07 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-12-29 05:33:37 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.43.38 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.43.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 00:33:31.935570 2025] [security2:error] [pid 17981:tid 17981] [client 104.207.43.38:44043] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "earlyeditionsbooks.com"] [uri "/.env"] [unique_id "aVISq2hK6EPw9xdBnYCjxgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 04:16:28 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.43.38 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.43.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 28 23:16:23.545235 2025] [security2:error] [pid 20408:tid 20408] [client 104.207.43.38:22049] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "modmove.com"] [uri "/.env"] [unique_id "aVIAl4wuT5AfdcaBcMGxxQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-12-08 22:48:47 (5 months ago)	botnet	DDoS Attack
Anonymous	2025-12-03 20:00:40 (6 months ago)	botnet	DDoS Attack
Anonymous	2025-11-17 16:08:39 (6 months ago)	Attempted brute force login to web vpn 12 time(s); last attempt for 2025.11.17 is noted in report ti ... show more Attempted brute force login to web vpn 12 time(s); last attempt for 2025.11.17 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-14 01:08:50 (6 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
Anonymous	2025-11-12 17:19:57 (6 months ago)	Attempted brute force login to web vpn 14 time(s); last attempt for 2025.11.12 is noted in report ti ... show more Attempted brute force login to web vpn 14 time(s); last attempt for 2025.11.12 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 131 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 221.226.232.42

🇰🇷 221.144.91.155

🇨🇳 106.75.189.53

🇲🇩 217.156.64.228

🇺🇸 208.84.100.71

🇺🇸 206.189.180.100

🇹🇼 198.235.24.106

🇦🇪 176.205.69.152

🇹🇭 147.50.103.212

🇬🇧 109.75.164.236

🇺🇸 107.172.204.15

🇨🇳 106.117.105.40

🇵🇰 103.134.2.20

🇺🇸 66.132.186.242

🇺🇸 45.8.19.194

🇺🇸 20.65.193.108

🇦🇹 213.225.38.154

🇨🇳 203.189.196.168

🇮🇩 202.10.41.249

🇺🇸 199.48.128.86