JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.52.97

104.207.52.97 was found in our database!

This IP was reported 129 times. Confidence of Abuse is 3%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.52.97

Whois 104.207.52.97

IP Abuse Reports for 104.207.52.97:

This IP address has been reported a total of 129 times from 15 distinct sources. 104.207.52.97 was first reported on June 6th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 backslash	2026-05-23 05:03:16 (1 week ago)		Bad Web Bot
🇺🇸 Epimetheus	2026-01-21 00:35:07 (4 months ago)	Unauthorized access attempts: From: 104.207.52.97 Method: HTTP GET URI Path: /.aws/credentials ... show more Unauthorized access attempts: From: 104.207.52.97 Method: HTTP GET URI Path: /.aws/credentials UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-20 20:10:07 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 15:10:03.193576 2026] [security2:error] [pid 32417:tid 32417] [client 104.207.52.97:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "upskirtcrazy.com"] [uri "/.git/HEAD"] [unique_id "aW_hG2ZFA2jnSFZSik0RbAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 fortypoundhead	2025-12-18 16:01:35 (5 months ago)	SQL Injection Attempt	SQL Injection Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:58:29 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:58:22.072517 2025] [security2:error] [pid 1817000:tid 1817022] [client 104.207.52.97:39051] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.e-dome.co.jp"] [uri "/.svn/wc.db"] [unique_id "aSU3bpiXM9qjzOaPIgQyPAAAAUo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:48:51 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:48:43.822862 2025] [security2:error] [pid 368:tid 368] [client 104.207.52.97:24235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tonysargbooks.com"] [uri "/.svn/wc.db"] [unique_id "aSUnG3qROh58q2h6R_T-FQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:55:14 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:55:03.066008 2025] [security2:error] [pid 25285:tid 25285] [client 104.207.52.97:56043] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.motioncontrolpartners.com"] [uri "/.env"] [unique_id "aSUah-pXHGWSAbDgiibCHwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Ocean Ascents	2025-11-25 00:40:07 (6 months ago)	Probe for vulnerabilities. Path attempted: /.svn/wc.db	Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 00:02:16 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:02:10.290859 2025] [security2:error] [pid 2035:tid 2035] [client 104.207.52.97:47595] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lawandaudit.com"] [uri "/.svn/wc.db"] [unique_id "aSTyArwN1Q_11iYPhbSXuQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-10-12 15:04:49 (7 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 104.207.52.97 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 12 11:04:44.821151 2025] [security2:error] [pid 32696:tid 32696] [client 104.207.52.97:51599] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|casadelsolmexico.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "casadelsolmexico.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aOvDjJq7EUnmC3DDeJLAegAAAAg"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Rosh	2025-10-01 12:14:11 (8 months ago)	[10/01/25 14:14:11] SSH: illegal login attempts	Brute-Force SSH
Anonymous	2025-04-07 03:09:28 (1 year ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.04.07 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.04.07 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-06 21:16:16 (1 year ago)	Attempted brute force login to web vpn 4 time(s); last attempt for 2025.04.06 is noted in report tim ... show more Attempted brute force login to web vpn 4 time(s); last attempt for 2025.04.06 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-04 14:21:39 (1 year ago)	Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.04 is noted in report tim ... show more Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.04 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-03 14:18:28 (1 year ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.04.03 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.04.03 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 129 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.181.108.114

🇺🇸 216.218.206.125

🇺🇸 207.90.244.20

🇺🇸 207.90.244.19

🇩🇪 159.195.28.149

🇬🇧 159.65.89.87

🇫🇮 147.185.133.7

🇺🇸 147.182.220.80

🇨🇳 120.84.10.151

🇸🇬 103.187.147.165

🇺🇸 47.251.242.234

🇸🇬 47.84.103.254

🇳🇱 31.14.32.8

🇯🇵 18.181.183.183

🇺🇸 2607:f8b0:4023:100d::122

🇸🇬 209.58.160.54

🇨🇳 182.40.195.233

🇺🇸 148.105.15.111

🇸🇬 104.28.156.107

🇲🇾 103.86.131.133