JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.48.156

104.207.48.156 was found in our database!

This IP was reported 146 times. Confidence of Abuse is 15%: ?

15%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.48.156

Whois 104.207.48.156

IP Abuse Reports for 104.207.48.156:

This IP address has been reported a total of 146 times from 22 distinct sources. 104.207.48.156 was first reported on June 12th 2024, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Bedios GmbH	2026-06-07 21:24:13 (12 hours ago)	SQL backup theft attempt	Hacking
🇩🇪 4server	2026-04-21 08:05:41 (1 month ago)	[TueApr2110:05:34.9431732026][security2:error][pid3025238:tid3025251][client104.207.48.156:0]ModSecu ... show more [TueApr2110:05:34.9431732026][security2:error][pid3025238:tid3025251][client104.207.48.156:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"giftech.ch\"][uri\"/database.sql\"][unique_id\"aecvzprE_IcxiUza34QW1gAAAAM\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 jjnxpct	2026-04-20 03:48:43 (1 month ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /dump.sql (Rule ID: 920440) - URL file extension is restricted by policy show less	Web App Attack SQL Injection Hacking
🇩🇪 Packets-Decreaser.NET	2025-12-31 01:00:56 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-11-25 06:42:15 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:42:07.467423 2025] [security2:error] [pid 12723:tid 12723] [client 104.207.48.156:50005] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.ycrlbasketball.com"] [uri "/.env"] [unique_id "aSVPvwX0ZZi5UHwY_-nNWQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 08:07:08 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 03:07:05.272432 2025] [security2:error] [pid 25106:tid 25162] [client 104.207.48.156:37633] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.madtruckerbill.com"] [uri "/.git/HEAD"] [unique_id "aSQSKTsFdfAxnE8Jg1Y0HQAAAZE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:23:08 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:23:00.183282 2025] [security2:error] [pid 22832:tid 22832] [client 104.207.48.156:26711] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.tribwatch.com"] [uri "/.env"] [unique_id "aSPrtB_JyvY80jvPOX6aEQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:19:04 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:18:57.558233 2025] [security2:error] [pid 18325:tid 18333] [client 104.207.48.156:32793] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.zammconstruction.com"] [uri "/.svn/wc.db"] [unique_id "aSPcsbibCkDUtlE56PAbQAAAAEY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:00:34 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:00:21.190898 2025] [security2:error] [pid 10399:tid 10399] [client 104.207.48.156:19197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cinemastation.video"] [uri "/.svn/wc.db"] [unique_id "aSPYVaqopTHVeahDbvgNsgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2025-10-29 03:23:56 (7 months ago)	Form spam	Web Spam
🇱🇻 garmtech.com	2025-10-17 22:41:46 (7 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 01-41.104.207.48.156.web-spamm ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 01-41.104.207.48.156.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇱🇻 garmtech.com	2025-10-14 20:44:49 (7 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 23-44.104.207.48.156.web-spamm ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 23-44.104.207.48.156.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
Anonymous	2025-04-06 19:25:11 (1 year ago)	Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.06 is noted in report tim ... show more Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.06 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-05 11:50:21 (1 year ago)	Attempted brute force login to web vpn 5 time(s); last attempt for 2025.04.05 is noted in report tim ... show more Attempted brute force login to web vpn 5 time(s); last attempt for 2025.04.05 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-04 22:20:05 (1 year ago)	Attempted brute force login to web vpn 6 time(s); last attempt for 2025.04.04 is noted in report tim ... show more Attempted brute force login to web vpn 6 time(s); last attempt for 2025.04.04 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 146 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.226.197.57

🇨🇳 182.135.63.175

🇺🇸 107.151.233.216

🇸🇪 90.230.115.5

🇷🇺 77.39.19.233

🇺🇦 62.149.14.56

🇨🇦 45.62.82.22

🇧🇪 35.190.202.214

🇨🇳 122.115.224.56

🇰🇷 110.14.190.217

🇳🇱 45.148.10.157

🇺🇸 40.124.175.16

🇺🇸 35.208.7.216

🇩🇪 34.141.99.68

🇩🇪 34.107.74.45

🇭🇰 34.96.230.50

🇰🇷 34.47.119.55

🇩🇪 18.198.188.215

🇭🇰 118.193.47.114

🇺🇸 69.175.33.170