JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.48.205

104.207.48.205 was found in our database!

This IP was reported 131 times. Confidence of Abuse is 35%: ?

35%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.48.205

Whois 104.207.48.205

IP Abuse Reports for 104.207.48.205:

This IP address has been reported a total of 131 times from 24 distinct sources. 104.207.48.205 was first reported on June 6th 2024, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇴 INTEQ	2026-06-16 13:00:42 (4 hours ago)	Web attack from 104.207.48.205	Web App Attack
🇩🇪 F242	2026-06-14 19:08:41 (1 day ago)	Wordpress Login or XMLRPC abuse	Web App Attack
🇩🇪 4server	2026-06-14 12:12:48 (2 days ago)	[SunJun1414:12:42.7229962026][security2:error][pid2397638:tid2397676][client104.207.48.205:0]ModSecu ... show more [SunJun1414:12:42.7229962026][security2:error][pid2397638:tid2397676][client104.207.48.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"gmint.ch\"][uri\"/wp-login.php\"][unique_id\"ai6auoIGxdWB6J8Ev6eI3AAAAEI\"]\,referer:https://gmint.ch/wp-login.php show less	Port Scan Brute-Force Web App Attack
🇬🇧 spamverify.com	2026-06-12 04:10:41 (4 days ago)	Honeypot Hit: WordPress Login	Web Spam Blog Spam Bad Web Bot Web App Attack
Anonymous	2026-06-10 17:19:55 (5 days ago)	Web attack blocked by Wordfence on vestingstadvalkenburg.nl (1 hit). Reported by CRMON.	Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 07:02:40 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.205 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:02:36.395178 2025] [security2:error] [pid 24297:tid 24297] [client 104.207.48.205:17291] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.xtrl.com"] [uri "/.env"] [unique_id "aSVUjJH_fh_NAKY_QpyPRgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:45:51 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.48.205 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.48.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:45:42.758072 2025] [security2:error] [pid 13310:tid 13310] [client 104.207.48.205:21169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "diepeveen.net"] [uri "/.svn/wc.db"] [unique_id "aSUmZtga9wdIT-4ZQrI7egAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-01 19:44:12 (7 months ago)	[redacted] 104.207.48.205 - - [01/Nov/2025:20:44:00 +0100] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" " ... show more [redacted] 104.207.48.205 - - [01/Nov/2025:20:44:00 +0100] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" [redacted] 104.207.48.205 - - [01/Nov/2025:20:44:01 +0100] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36" [redacted] 104.207.48.205 - - [01/Nov/2025:20:44:02 +0100] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" [redacted] 104.207.48.205 - - [01/Nov/2025:20:44:03 +0100] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" [redacted] 104.207.48.205 - - [01/Nov/2025:20:44:05 +0100] "POST /xmlrpc.php HTTP/2.0" 200 401 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/602.2.14 (KHTML, like Gecko) Versi ... show less	Hacking Web App Attack
🇦🇺 AWW-Admin	2025-10-29 12:43:51 (7 months ago)	(wordpress) Failed wordpress login from 104.207.48.205 (BR/Brazil/-)	Brute-Force
🇳🇱 EGP Abuse Dept	2025-10-26 09:32:46 (7 months ago)	Unauthorized connection to SSH port 22	Port Scan Hacking SSH
🇫🇮 bittiguru.fi	2025-10-25 08:33:24 (7 months ago)	Oct 25 11:33:21 taivassalofi sshd[10018]: pam_unix(sshd:auth): authentication failure; logname= uid= ... show more Oct 25 11:33:21 taivassalofi sshd[10018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.207.48.205 Oct 25 11:33:23 taivassalofi sshd[10018]: Failed password for invalid user [email protected] from 104.207.48.205 port 49699 ssh2 ... show less	Brute-Force SSH
Anonymous	2025-10-11 00:02:20 (8 months ago)	Attempted brute force login to web vpn 36 time(s); last attempt for 2025.10.11 is noted in report ti ... show more Attempted brute force login to web vpn 36 time(s); last attempt for 2025.10.11 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-10 22:51:47 (8 months ago)	Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.10 is noted in report t ... show more Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.10 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-09 12:02:24 (8 months ago)	Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.09 is noted in report ti ... show more Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.09 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-08 21:55:22 (8 months ago)	Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.08 is noted in report t ... show more Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.08 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 131 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.218.206.123

🇺🇸 154.39.79.49

🇩🇪 128.14.225.164

🇻🇳 113.173.154.153

🇨🇳 112.80.175.1

🇺🇦 77.87.40.114

🇰🇷 59.16.192.32

🇹🇭 58.10.48.167

🇭🇰 47.242.245.129

🇱🇹 45.227.254.170

🇺🇸 35.212.170.115

🇳🇱 5.61.209.43

🇶🇦 2600:1900:4260:40e::2e

🇫🇷 176.129.57.20

🇳🇱 176.65.139.215

🇺🇸 135.119.88.104

🇻🇳 123.22.187.96

🇹🇼 111.70.32.6

🇸🇬 47.237.174.42

🇳🇱 45.156.87.253