JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.47.2

104.207.47.2 was found in our database!

This IP was reported 91 times. Confidence of Abuse is 20%: ?

20%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.47.2

Whois 104.207.47.2

IP Abuse Reports for 104.207.47.2:

This IP address has been reported a total of 91 times from 22 distinct sources. 104.207.47.2 was first reported on June 20th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 NervousNiffler	2026-10-04 08:05:38 (2 weeks ago)	[PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [Xm ... show more [PathScanning] Path scanning/probing detected: WordPress system file probe (path: /xmlrpc.php) \| [XmlRpc] XML-RPC abuse detected: POST request to xmlrpc.php; Dangerous XML-RPC method: system.multicall; Dangerous XML-RPC method: wp.getUsersBlogs show less	Port Scan Hacking Brute-Force Web App Attack
🇨🇿 lp	2026-09-23 10:49:36 (4 weeks ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 104.207.47.2 2026-09-23T11:39:11+02:0 ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 104.207.47.2 2026-09-23T11:39:11+02:00 vpn Access-Reject 'administrator' station: 104.207.47.2 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇺🇸 ctidrv	2026-09-20 23:59:03 (1 month ago)	Honeypot detection. Threat score: 85/100. Collector: wp_login. \| Request: POST /wp-login.php \| Crede ... show more Honeypot detection. Threat score: 85/100. Collector: wp_login. \| Request: POST /wp-login.php \| Credentials captured: user=ad2min \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:119.0) Gecko/20100101 Firefox/119.0 \| rDNS: 104.207.47.2 \| Reasons: wp_login_probe, wp_credentials_submitted show less	Brute-Force Bad Web Bot
🇩🇪 FeG Deutschland	2026-09-08 20:34:34 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
Anonymous	2026-09-03 21:10:54 (1 month ago)	2026-09-03T23:10:53.553872+02:00 polaris wp(bikeschool.co.za)[848423]: Authentication attempt for un ... show more 2026-09-03T23:10:53.553872+02:00 polaris wp(bikeschool.co.za)[848423]: Authentication attempt for unknown user SoporteAna from 104.207.47.2 ... show less	Brute-Force Web App Attack
Anonymous	2026-03-26 16:32:10 (6 months ago)	Forum/form spam	Web Spam
🇺🇸 TPI-Abuse	2026-02-12 06:24:30 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 01:24:25.102352 2026] [security2:error] [pid 27251:tid 27251] [client 104.207.47.2:49035] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "artspacecleveland.com"] [uri "/config/.env"] [unique_id "aY1yGTrlC98NEFU-P81h3QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-12 02:16:38 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 21:16:32.703178 2026] [security2:error] [pid 22376:tid 22376] [client 104.207.47.2:56291] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arroceraomoa.com"] [uri "/dev/.git/config"] [unique_id "aY04AK5jYkb-Zz0Dgb--7AAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-11 20:50:21 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 15:50:14.436658 2026] [security2:error] [pid 889537:tid 889537] [client 104.207.47.2:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ard.global"] [uri "/app/.git/config"] [unique_id "aYzrhl6cFcxD_MbWKanxxQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 03:00:07 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:58:38.331049 2026] [security2:error] [pid 21718:tid 21718] [client 104.207.47.2:44755] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "i-med.com"] [uri "/app/.env"] [unique_id "aYqe3p9Yskcy3KqWfiIvrQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 00:31:50 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 19:31:42.946566 2026] [security2:error] [pid 5269:tid 5288] [client 104.207.47.2:44595] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.com"] [uri "/v2/.git/config"] [unique_id "aYp8brk8htmo_Z-NcJ6owwAAAJE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 21:08:51 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 16:08:39.330629 2026] [security2:error] [pid 22411:tid 22411] [client 104.207.47.2:12647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "karenbernsteinlaw.net"] [uri "/wp/.git/config"] [unique_id "aYpM161cSTAOg7aFKi6JDgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 wlt-blocker	2026-01-03 02:30:42 (9 months ago)	Unauthorized access to webpage admin	Web App Attack
🇩🇪 F242	2026-01-02 13:44:23 (9 months ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇺🇸 fbarela	2025-12-28 14:00:03 (9 months ago)	FortiGate SSL VPN login failures.	Hacking Brute-Force

Showing 1 to 15 of 91 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 92.118.39.50

🇺🇸 66.132.172.185

🇺🇸 45.66.208.150

🇺🇸 24.199.92.28

🇹🇭 223.204.233.45

🇧🇷 201.86.71.182

🇭🇰 148.66.49.226

🇩🇪 130.12.180.117

🇮🇳 103.248.120.6

🇦🇺 79.127.155.77

🇧🇬 79.124.56.214

🇩🇪 69.5.169.224

🇵🇭 49.146.34.166

🇬🇧 213.166.84.34

🇹🇼 203.203.93.21

🇭🇰 202.55.17.42

🇧🇷 200.196.50.91

🇳🇱 185.136.15.30

🇵🇭 160.187.220.144

🇺🇸 156.232.10.218