JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.53.74

104.207.53.74 was found in our database!

This IP was reported 140 times. Confidence of Abuse is 21%: ?

21%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.53.74

Whois 104.207.53.74

IP Abuse Reports for 104.207.53.74:

This IP address has been reported a total of 140 times from 15 distinct sources. 104.207.53.74 was first reported on June 5th 2024, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 TheCoon	2026-05-13 07:15:01 (3 weeks ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇩🇪 4server	2026-05-13 03:53:24 (3 weeks ago)	[WedMay1305:53:19.7073312026][security2:error][pid1056808:tid1056911][client104.207.53.74:0]ModSecur ... show more [WedMay1305:53:19.7073312026][security2:error][pid1056808:tid1056911][client104.207.53.74:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"orabonastudio.it\"][uri\"/.git/HEAD\"][unique_id\"agP1rxrpbCD--M17VYpljAAAAQI\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 wlt-blocker	2026-05-11 05:03:34 (3 weeks ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 12:34:09 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.207.53.74 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.53.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 08:34:03.122656 2026] [security2:error] [pid 12406:tid 12406] [client 104.207.53.74:15633] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chelseafootballprogrammes.com"] [uri "/.svn/wc.db"] [unique_id "agB7O-QmUrZ5A8gONl4eHwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 [email protected]	2026-04-18 06:16:02 (1 month ago)	[Sat Apr 18 08:16:01.454907 2026] [authz_core:error] [pid 560720:tid 560763] [remote 104.207.53.74:6 ... show more [Sat Apr 18 08:16:01.454907 2026] [authz_core:error] [pid 560720:tid 560763] [remote 104.207.53.74:62835] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/wp-login.php ... show less	Brute-Force Web App Attack
Anonymous	2026-02-16 16:39:00 (3 months ago)		Web Spam
🇨🇭 backslash	2026-02-14 14:40:10 (3 months ago)	block ruleset 6A1105329D233F6F53B9B61CE056BD4DAAE75AB4	Web Spam
🇺🇸 TPI-Abuse	2026-02-06 05:53:07 (4 months ago)	(mod_security) mod_security (id:217280) triggered by 104.207.53.74 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:217280) triggered by 104.207.53.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 06 00:53:01.147539 2026] [security2:error] [pid 26053:tid 26053] [client 104.207.53.74:57939] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\\\n\|\\\\r)+(?:get\|post\|head\|options\|connect\|put\|delete\|trace\|propfind\|propatch\|mkcol\|copy\|move\|lock\|unlock)\\\\s+" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "137"] [id "217280"] [rev "6"] [msg "COMODO WAF: HTTP Request Smuggling Attack\|\|digitalmarketing-group.com\|F\|2"] [data "Matched Data: get found within MATCHED_VAR"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "digitalmarketing-group.com"] [uri "/scripts/form-1234-9ea1.php"] [unique_id "aYWBvYzSsgXjFhBZ4M1_3QAAAAI"], referer: https://digitalmarketing-group.com/Home.html show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-02-05 04:13:08 (4 months ago)	Form spam	Web Spam
🇦🇺 oncord	2026-02-02 20:39:23 (4 months ago)	Form spam	Web Spam
🇦🇺 oncord	2026-01-28 16:24:12 (4 months ago)	Form spam	Web Spam
Anonymous	2026-01-03 13:42:06 (5 months ago)	Attempted brute force login to web vpn 18 time(s); last attempt for 2026.01.03 is noted in report ti ... show more Attempted brute force login to web vpn 18 time(s); last attempt for 2026.01.03 is noted in report timestamp show less	Hacking Brute-Force
🇦🇺 oncord	2026-01-02 04:05:34 (5 months ago)	Form spam	Web Spam
🇦🇺 oncord	2025-12-31 21:47:38 (5 months ago)	Form spam	Web Spam
🇱🇻 garmtech.com	2025-12-31 13:16:16 (5 months ago)	IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 15-16.104.207.53.74.web-spamme ... show more IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 15-16.104.207.53.74.web-spammers.v2.rbl.imunify.com._v4 succeeded. show less	Web App Attack

Showing 1 to 15 of 140 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 221.233.69.217

🇸🇪 176.10.197.168

🇵🇰 153.117.9.143

🇺🇸 107.167.122.22

🇮🇳 106.221.253.14

🇮🇳 43.251.172.3

🇧🇷 186.238.210.226

🇳🇱 185.242.226.97

🇭🇰 185.227.153.56

🇺🇸 184.105.139.94

🇨🇳 122.224.240.99

🇹🇭 110.49.146.23

🇳🇱 45.148.10.151

🇯🇵 43.165.170.19

🇺🇸 20.64.105.238

🇺🇸 195.214.120.171

🇧🇷 191.54.80.93

🇳🇱 176.65.139.210

🇺🇿 144.124.192.129

🇨🇳 123.14.82.243