AbuseIPDB » 104.207.48.204

104.207.48.204 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 27%: ?

27%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
Domain Name	3xktech.cloud
Country	Canada
City	Toronto, Ontario

Report 104.207.48.204

Whois 104.207.48.204

IP Abuse Reports for 104.207.48.204:

This IP address has been reported a total of 17 times from 11 distinct sources. 104.207.48.204 was first reported on June 4th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2024-11-28 13:45:18 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 28 08:45:12.678591 2024] [security2:error] [pid 2846:tid 2846] [client 104.207.48.204:23215] [client 104.207.48.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|lbee.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lbee.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z0hz6Aj8vLhJFI3Z3HHMZAAAAAk"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-11-20 15:11:11 (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 20 10:11:05.797162 2024] [security2:error] [pid 824101:tid 824101] [client 104.207.48.204:32377] [client 104.207.48.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|kln.ne.jp\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kln.ne.jp"] [uri "/wp-json/wp/v2/users"] [unique_id "Zz38CQu6zw0bN0Mk9a9TxwAAAAc"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-11-17 00:29:17 (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 16 19:29:13.364147 2024] [security2:error] [pid 29215:tid 29215] [client 104.207.48.204:54789] [client 104.207.48.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|benshermanguitar.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "benshermanguitar.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Zzk42SgJ_XFPCbmtbH7O7wAAAAY"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Major Hostility	2024-11-16 17:41:29 (3 weeks ago)	"GET /wp-json/wp/v2/users HTTP/1.1" 404 "GET /wp-json/wp/v2/users HTTP/1.1" 404 "POST /x ... show more"GET /wp-json/wp/v2/users HTTP/1.1" 404 "GET /wp-json/wp/v2/users HTTP/1.1" 404 "POST /xmlrpc.php HTTP/1.1" 403 "GET /wp-login.php HTTP/1.1" 404 "GET /wp-login.php HTTP/1.1" 404 "POST /xmlrpc.php HTTP/1.1" 403 show less	Web App Attack
nyuuzyou	2024-11-15 04:00:42 (3 weeks ago)	Intensive scraping: /web?s=geolocation%20advertising%20network&country=li-li&scraper=yandex. User-Ag ... show moreIntensive scraping: /web?s=geolocation%20advertising%20network&country=li-li&scraper=yandex. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71. show less	Bad Web Bot
www.tana.it	2024-11-08 03:27:56 (1 month ago)	PHP scan	Web App Attack
nyuuzyou	2024-11-07 19:48:21 (1 month ago)	Intensive scraping: /web?s=%D8%A7%D9%84%D8%A8%D8%B0%D9%88%D8%B1%20%D8%B6%D8%B1%D9%88%D8%B1%D9%8A%D8% ... show moreIntensive scraping: /web?s=%D8%A7%D9%84%D8%A8%D8%B0%D9%88%D8%B1%20%D8%B6%D8%B1%D9%88%D8%B1%D9%8A%D8%A9%20%D9%84%D8%B2%D8%B1%D8%A7%D8%B9%D8%A9%20%D8%A7%D9%84%D8%B0%D8%B1%D8%A9%20%D8%A7%D9%84%D8%B1%D8%A8%D9%8A%D8%B9%D9%8A%D8%A9.&country=ak-ak&scraper=yandex. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71. show less	Bad Web Bot
Hirte	2024-11-05 11:43:17 (1 month ago)	DIS: Web Attack GET /wp-login.php	Web Spam Hacking Bad Web Bot Web App Attack
TPI-Abuse	2024-11-04 13:56:10 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 04 08:56:06.985790 2024] [security2:error] [pid 7085:tid 7085] [client 104.207.48.204:26047] [client 104.207.48.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|cartiologyfilms.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cartiologyfilms.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ZyjSdk2-Ov9Hz5AavTlc2wAAAAE"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Jean Valjean	2024-10-21 07:27:47 (1 month ago)	Fail2ban Caboom : wp-login.php Bruteforce	Brute-Force Web App Attack
TPI-Abuse	2024-10-21 01:19:35 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:225170) triggered by 104.207.48.204 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 20 21:19:32.783166 2024] [security2:error] [pid 12121:tid 12121] [client 104.207.48.204:60695] [client 104.207.48.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|thelongway.us\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thelongway.us"] [uri "/wp-json/wp/v2/users"] [unique_id "ZxWsJEWbnLsjIKDlmSwxsgAAAAs"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
statistics indonesia	2024-10-19 16:11:20 (1 month ago)	XML RPC Scan Activities	Brute-Force Web App Attack
gszasz	2024-07-14 08:58:13 (4 months ago)	2024-07-14T10:58:10.844132 phoenix sshd[1449403]: pam_unix(sshd:auth): authentication failure; logna ... show more2024-07-14T10:58:10.844132 phoenix sshd[1449403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.207.48.204 2024-07-14T10:58:12.710651 phoenix sshd[1449403]: Failed password for invalid user rrlyrbincan from 104.207.48.204 port 49624 ssh2 2024-07-14T10:58:12.968740 phoenix sshd[1449403]: Connection closed by invalid user rrlyrbincan 104.207.48.204 port 49624 [preauth] ... show less	Brute-Force SSH
wil.com	2024-06-25 18:58:21 (5 months ago)	GlobalProtect login attempts with user brigitte.	VPN IP Brute-Force
Anonymous	2024-06-22 14:32:36 (5 months ago)	VPN Authentication Brute Force	Brute-Force Brute-Force