JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.52.135

104.207.52.135 was found in our database!

This IP was reported 141 times. Confidence of Abuse is 18%: ?

18%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.52.135

Whois 104.207.52.135

IP Abuse Reports for 104.207.52.135:

This IP address has been reported a total of 141 times from 21 distinct sources. 104.207.52.135 was first reported on June 6th 2024, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Reinhard	2026-06-14 12:11:08 (5 days ago)	Unclassified dangerous activity detected.	Hacking
🇩🇪 Bedios GmbH	2026-06-12 07:10:23 (1 week ago)	SQL backup theft attempt	Hacking
🇩🇪 4server	2026-05-09 02:35:16 (1 month ago)	[SatMay0904:35:12.2755172026][security2:error][pid2902427:tid2902457][client104.207.52.135:0]ModSecu ... show more [SatMay0904:35:12.2755172026][security2:error][pid2902427:tid2902457][client104.207.52.135:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$curl\\|wget\\|python\\|nikto\\|sqlmap\\|acunetix\\|fimap\\|dirbuster\\|cmsmap$\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"www.pulispina.ch.136-243-54-122.cpanel.site\"][uri\"/wp-json/gravitysmtp/v1/tests/mock-data\"][unique_id\"af6dYKIJTGLhgQGbmDi9OQAAABI\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 4server	2026-04-21 09:34:05 (1 month ago)	[TueApr2111:34:02.5077182026][security2:error][pid3025358:tid3025383][client104.207.52.135:0]ModSecu ... show more [TueApr2111:34:02.5077182026][security2:error][pid3025358:tid3025383][client104.207.52.135:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"casacarmen.ch\"][uri\"/data.sql\"][unique_id\"aedEihhJ3UcICK2T19yIpwAAARY\"] show less	Port Scan Brute-Force Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
🇺🇸 TPI-Abuse	2025-12-27 20:31:57 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 15:31:52.297513 2025] [security2:error] [pid 20489:tid 20489] [client 104.207.52.135:13957] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flowergirlbaskets.com"] [uri "/.env"] [unique_id "aVBCOOfz4_GbTvR-taAMvQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 19:51:05 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 14:50:57.497631 2025] [security2:error] [pid 24224:tid 24224] [client 104.207.52.135:50669] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "isaacsonpaintings.com"] [uri "/.env"] [unique_id "aVA4oe3qTcbUDg2doye6TAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 19:07:32 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 14:07:26.531169 2025] [security2:error] [pid 28546:tid 28546] [client 104.207.52.135:29659] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hills-tax.com"] [uri "/.env"] [unique_id "aVAubnu3u4clpVWPrWKNoAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-12-27 18:10:39 (5 months ago)	"GET /.svn/wc.db HTTP/1.1"	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 16:47:09 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 11:47:02.775838 2025] [security2:error] [pid 2852:tid 2881] [client 104.207.52.135:51293] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trust-more.com"] [uri "/.env"] [unique_id "aVANhneq7BsfisjpkAYmsQAAANg"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2025-12-05 07:11:32 (6 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-11.104.207.52.135.web-spamm ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 09-11.104.207.52.135.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇱🇻 garmtech.com	2025-12-05 00:20:40 (6 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 02-20.104.207.52.135.web-spamm ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 02-20.104.207.52.135.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack
🇮🇳 Mcshield.org	2025-12-01 02:03:57 (6 months ago)	Possible port scan detected from 104.207.52.135 (masscan/nmap signature)	Email Spam Port Scan
🇳🇱 jjnxpct	2025-11-26 04:55:59 (6 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.git/HEAD (Rule ID: 930130) - Restricted File Access Attempt [Suspicious: .git/ found within REQUEST_FILENAME: /.git/HEAD] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 05:16:59 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:16:55.636982 2025] [security2:error] [pid 11093:tid 11093] [client 104.207.52.135:23131] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "edgecomix.edgeimprov.com"] [uri "/.git/HEAD"] [unique_id "aSU7x7i5sma2OurqAOLENgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 141 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 216.155.93.75

🇺🇸 184.105.139.77

🇺🇸 205.210.31.107

🇻🇪 190.153.18.56

🇨🇴 186.168.71.24

🇨🇳 139.9.191.197

🇺🇸 20.118.209.129

🇺🇸 20.64.105.88

🇭🇰 220.246.66.209

🇨🇴 191.95.54.149

🇷🇺 185.40.30.168

🇳🇱 176.65.139.181

🇳🇱 172.94.9.55

🇺🇸 136.175.58.195

🇳🇱 45.148.10.151

🇬🇧 35.203.211.223

🇩🇪 2.56.245.171

🇺🇸 147.185.132.160

🇨🇳 113.249.101.174

🇷🇸 109.207.38.123