JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.49.200

104.207.49.200 was found in our database!

This IP was reported 143 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.49.200

Whois 104.207.49.200

IP Abuse Reports for 104.207.49.200:

This IP address has been reported a total of 143 times from 20 distinct sources. 104.207.49.200 was first reported on June 7th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 [email protected]	2026-04-17 22:58:15 (1 month ago)	[Sat Apr 18 00:58:15.207704 2026] [authz_core:error] [pid 560721:tid 560756] [remote 104.207.49.200: ... show more [Sat Apr 18 00:58:15.207704 2026] [authz_core:error] [pid 560721:tid 560756] [remote 104.207.49.200:50417] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/wp-login.php ... show less	Brute-Force Web App Attack
🇨🇭 filou812	2026-02-10 07:07:51 (4 months ago)	url tried is "/.env.save"	Web App Attack
🇺🇸 myagent.site	2026-02-09 22:10:48 (4 months ago)	Blocking for trying to access an exploit file: /app/.env	Hacking
🇺🇸 TPI-Abuse	2026-02-09 19:42:15 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 14:42:07.940715 2026] [security2:error] [pid 27714:tid 27714] [client 104.207.49.200:28565] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gadgeteer.net"] [uri "/backend/.env"] [unique_id "aYo4j6rOmltfH9BxG1NXBAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 18:58:35 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 13:58:29.209696 2026] [security2:error] [pid 14873:tid 14873] [client 104.207.49.200:15105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fynyx.com"] [uri "/admin/.git/config"] [unique_id "aYouVTOeHKPKCZoF1AXLrgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 17:58:24 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 12:58:16.297722 2026] [security2:error] [pid 21583:tid 21583] [client 104.207.49.200:12561] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "furballaudio.com"] [uri "/app/.env"] [unique_id "aYogON2fuhwo1uZjY6_8KQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 12:56:56 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 07:56:53.520843 2026] [security2:error] [pid 24059:tid 24059] [client 104.207.49.200:12365] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fundingworkingcapital.com"] [uri "/.env.staging"] [unique_id "aYnZlRX5cdTFrMe4m7n8hQAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 09:01:37 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 04:01:31.558656 2026] [security2:error] [pid 2203:tid 2203] [client 104.207.49.200:38571] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "g-drome.com"] [uri "/backend/.env"] [unique_id "aYmia0Momf6Ow-LfBURfaQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2025-12-30 02:55:11 (5 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 myagent.site	2025-11-25 18:17:15 (6 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇺🇸 TPI-Abuse	2025-11-25 04:18:04 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:17:55.959082 2025] [security2:error] [pid 4505:tid 4505] [client 104.207.49.200:49763] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cultiplant.com.menagri.com"] [uri "/.git/HEAD"] [unique_id "aSUt85eJJXWMXsMqVVKuHAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:47:28 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:47:19.829878 2025] [security2:error] [pid 1737:tid 1737] [client 104.207.49.200:9249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.hawkinsenterprise.com"] [uri "/.git/HEAD"] [unique_id "aSUYt_oO5HDJ9k1L5ZC7ygAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 01:59:33 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:59:30.395314 2025] [security2:error] [pid 14399:tid 14399] [client 104.207.49.200:9941] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.writebetweenthelines.com"] [uri "/.env"] [unique_id "aSUNgoZeNDq27xAfM0OduAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 00:24:35 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.49.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:24:26.240757 2025] [security2:error] [pid 18222:tid 18222] [client 104.207.49.200:11051] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.geckoturner.chezlubacov.xyz"] [uri "/.env"] [unique_id "aST3OixiX-L9mrZba1zY7QAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-19 15:10:40 (7 months ago)	Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.19 is noted in report t ... show more Attempted brute force login to web vpn 108 time(s); last attempt for 2025.10.19 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 143 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2602:fb54:99a::

🇬🇧 193.163.125.8

🇩🇪 167.94.145.21

🇸🇬 109.111.197.144

🇵🇰 43.230.92.36

🇵🇱 31.179.197.26

🇬🇪 2.57.217.229

🇨🇳 223.104.124.244

🇦🇷 168.197.250.14

🇭🇰 118.141.221.150

🇺🇸 104.232.209.182

🇳🇱 45.148.10.147

🇺🇸 34.181.234.14

🇺🇸 20.163.5.98

🇨🇳 218.8.44.26

🇦🇹 209.242.202.61

🇸🇬 194.5.82.73

🇺🇸 167.253.18.97

🇳🇱 160.119.76.17

🇷🇴 141.98.83.240