JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.46.22

104.207.46.22 was found in our database!

This IP was reported 133 times. Confidence of Abuse is 21%: ?

21%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.46.22

Whois 104.207.46.22

IP Abuse Reports for 104.207.46.22:

This IP address has been reported a total of 133 times from 28 distinct sources. 104.207.46.22 was first reported on June 4th 2024, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 drewf.ink	2026-08-29 14:04:33 (3 days ago)	[14:04] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [14:04] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇲🇽 octageeks.com	2026-08-13 04:24:33 (2 weeks ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇫🇷 Sklurk	2026-08-01 00:07:01 (1 month ago)	Web App Attack	Web App Attack
🇳🇿 Antinson	2026-07-08 11:37:56 (1 month ago)	Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)	Bad Web Bot
🇺🇸 TAY	2026-06-14 07:36:05 (2 months ago)	104.207.46.22 - - [14/Jun/2026:15:36:02 +0800] "GET /wp-admin/admin.php?page=miwoftp&option=com_miwo ... show more 104.207.46.22 - - [14/Jun/2026:15:36:02 +0800] "GET /wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=download&item=..%2Fwp-config.php&order=name&srt=yes HTTP/1.1" 301 657 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 104.207.46.22 - - [14/Jun/2026:15:36:03 +0800] "GET /wp-admin/admin.php?page=newsletters-history&wpmlmethod=exportdownload&file=..%2Fwp-config.php HTTP/1.1" 301 613 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 104.207.46.22 - - [14/Jun/2026:15:36:04 +0800] "GET /wp-admin/edit.php?page=wp-db-backup.php&backup=..%2Fwp-config.php HTTP/1.1" 301 553 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" ... show less	Brute-Force
🇬🇧 PeravixGroup	2026-06-09 15:51:08 (2 months ago)	Honeypot detection: Apache CouchDB unauthorized access / exploitation attempt on port 5984. Severity ... show more Honeypot detection: Apache CouchDB unauthorized access / exploitation attempt on port 5984. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇨🇭 4server	2026-05-11 09:16:53 (3 months ago)	[MonMay1111:16:48.6357082026][security2:error][pid4097884:tid4097911][client104.207.46.22:0]ModSecur ... show more [MonMay1111:16:48.6357082026][security2:error][pid4097884:tid4097911][client104.207.46.22:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"pmprogettazione.ch\"][uri\"/.env\"][unique_id\"agGegDw-8q3Z2RyAjLy-NwAAAQ4\"] show less	Hacking Web App Attack
🇺🇸 octageeks.com	2026-04-15 04:07:00 (4 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇺🇸 mnsf	2026-02-16 02:06:16 (6 months ago)	Scanning/Probing (24)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 11:57:22 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:57:16.683508 2026] [security2:error] [pid 12789:tid 12795] [client 104.207.46.22:45541] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teanaunz.com"] [uri "/site/.git/config"] [unique_id "aZG0nB0_RFMVRLILfS0sPwAAAQQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 myagent.site	2026-02-15 11:52:12 (6 months ago)	Blocking for trying to access an exploit file: /frontend/.env	Hacking
🇺🇸 TPI-Abuse	2026-02-15 05:26:03 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 00:25:56.152158 2026] [security2:error] [pid 21311:tid 21311] [client 104.207.46.22:30835] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "supportourlibrary.org"] [uri "/dev/.git/config"] [unique_id "aZFY5O0c7a2jaKvI_RwHIAAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 jjnxpct	2026-02-15 04:48:28 (6 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /wp/.git/config (Rule ID: 930130) - Restricted File Access Attempt show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 04:29:41 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 23:29:35.245176 2026] [security2:error] [pid 2458653:tid 2458653] [client 104.207.46.22:46043] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stsis.me"] [uri "/dev/.git/config"] [unique_id "aZFLr-PanvcAVkcKU-SczAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 03:37:52 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.46.22 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 22:37:46.177656 2026] [security2:error] [pid 9372:tid 9372] [client 104.207.46.22:14827] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stefchild.com"] [uri "/dev/.git/config"] [unique_id "aZE_iuvLPcO_if8SPBOl2QAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 133 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.60

🇷🇴 193.32.162.84

🇧🇷 187.51.208.158

🇺🇸 147.185.132.87

🇨🇳 125.124.175.173

🇮🇳 98.70.48.241

🇭🇰 34.150.29.213

🇺🇸 20.51.199.48

🇯🇵 4.190.169.224

🇨🇱 181.163.100.241

🇺🇸 147.185.132.85

🇺🇸 147.185.132.72

🇳🇱 78.142.18.40

🇺🇸 64.225.30.2

🇧🇪 34.38.29.62

🇨🇱 181.162.100.50

🇵🇪 179.6.3.71

🇭🇰 172.81.105.229

🇺🇿 170.168.6.27

🇺🇸 162.216.150.149