JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.47.115

104.207.47.115 was found in our database!

This IP was reported 146 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.47.115

Whois 104.207.47.115

IP Abuse Reports for 104.207.47.115:

This IP address has been reported a total of 146 times from 23 distinct sources. 104.207.47.115 was first reported on June 3rd 2024, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 VHosting	2026-02-18 22:16:54 (3 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇫🇷 Jean Valjean	2026-01-04 17:49:37 (5 months ago)	Fail2ban Caboom : xmlrpc.php Abuse	SQL Injection Web App Attack
Anonymous	2026-01-04 03:08:01 (5 months ago)	(XMLRPC) WP XMLPRC Attack 104.207.47.115 (US/United States/-): 5 in the last 3600 secs; Ports: ; Di ... show more (XMLRPC) WP XMLPRC Attack 104.207.47.115 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: 1 show less	Brute-Force SSH
🇦🇺 oncord	2025-12-22 08:40:32 (5 months ago)	Form spam	Web Spam
🇺🇸 COMPLEX	2025-12-15 04:46:39 (5 months ago)	Triggered Cloudflare WAF (l7ddos) from US. Action taken: BLOCK ASN: 200373 (DREI-K-TECH-GMBH) Protoc ... show more Triggered Cloudflare WAF (l7ddos) from US. Action taken: BLOCK ASN: 200373 (DREI-K-TECH-GMBH) Protocol: HTTP/2 (GET method) Endpoint: / show less	DDoS Attack Bad Web Bot
🇱🇻 garmtech.com	2025-12-14 17:24:02 (5 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-24.104.207.47.115.web-spamm ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-24.104.207.47.115.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:20:18 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:20:03.793395 2025] [security2:error] [pid 20072:tid 20072] [client 104.207.47.115:23307] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.pwilts.com"] [uri "/.svn/wc.db"] [unique_id "aSQHI0myVxnx_Oj1gNuqBwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:45:44 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:45:37.989160 2025] [security2:error] [pid 8217:tid 8217] [client 104.207.47.115:33425] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.madisonworkshopwest.com"] [uri "/.svn/wc.db"] [unique_id "aSPxAfLpBg1IF5m-blXEPQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:16:39 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:16:36.708509 2025] [security2:error] [pid 10696:tid 10831] [client 104.207.47.115:12147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.maritimeclinic.net"] [uri "/.git/HEAD"] [unique_id "aSPqNCJafRnFKTiRlooh0wAAAVU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 03:59:50 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 22:59:47.434169 2025] [security2:error] [pid 5624:tid 5624] [client 104.207.47.115:37471] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cincypcs.savingshvac.com"] [uri "/.git/HEAD"] [unique_id "aSPYM08cSzV8XeVfVLeU1wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nowyouknow	2025-11-24 01:47:07 (6 months ago)	(From [email protected]) Are you searching for a job that can be done right away? If so, cou ... show more (From [email protected]) Are you searching for a job that can be done right away? If so, countless businesses are hiring website chat support agents - no experience is needed, as full training will be provided. Click here to complete your application if you are interested. -----> https://themoneyfromhome.com show less	Phishing Web Spam
🇺🇸 nowyouknow	2025-11-21 12:21:29 (6 months ago)	(From [email protected]) Are you searching for a job that can be done right away? If so, c ... show more (From [email protected]) Are you searching for a job that can be done right away? If so, countless businesses are hiring website chat support agents - no experience is needed, as full training will be provided. Click here to complete your application if you are interested. -----> https://themoneyfromhome.com show less	Phishing Web Spam
🇺🇸 nowyouknow	2025-11-20 00:15:15 (6 months ago)	(From [email protected]) Are you searching for a job that can be done right away? If so, cou ... show more (From [email protected]) Are you searching for a job that can be done right away? If so, countless businesses are hiring website chat support agents - no experience is needed, as full training will be provided. Click here to complete your application if you are interested. -----> THEmoneyfromhome.com show less	Phishing Web Spam
🇺🇸 TPI-Abuse	2025-11-16 04:30:20 (6 months ago)	(mod_security) mod_security (id:210730) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 104.207.47.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 23:30:17.434670 2025] [security2:error] [pid 24363:tid 24363] [client 104.207.47.115:42983] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mail.quantumacceleration.org\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.quantumacceleration.org"] [uri "/s3cmd.ini"] [unique_id "aRlTWa8rIMOnw2BO121Q2QAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-14 08:34:20 (6 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack

Showing 1 to 15 of 146 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 2a02:4780:13:986:0:1fb3:5ea6:1

🇹🇼 111.70.14.135

🇳🇵 103.104.234.12

🇨🇳 101.67.136.13

🇰🇷 211.223.41.90

🇧🇷 200.108.174.4

🇺🇿 198.163.192.183

🇧🇷 186.238.247.238

🇮🇩 182.9.35.142

🇺🇸 162.216.149.236

🇺🇸 147.185.132.250

🇺🇸 128.203.200.182

🇭🇰 119.12.167.14

🇺🇸 52.176.37.68

🇷🇴 2.57.121.25

🇬🇧 213.166.84.47

🇺🇸 162.216.150.221

🇺🇸 162.216.149.211

🇨🇳 123.13.68.108

🇨🇳 121.26.31.62