JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.54.147

104.207.54.147 was found in our database!

This IP was reported 158 times. Confidence of Abuse is 20%: ?

20%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.54.147

Whois 104.207.54.147

IP Abuse Reports for 104.207.54.147:

This IP address has been reported a total of 158 times from 24 distinct sources. 104.207.54.147 was first reported on June 4th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Bedios GmbH	2026-06-10 03:16:55 (1 week ago)	SQL backup theft attempt	Hacking
🇩🇪 raph	2026-06-07 20:11:10 (1 week ago)	[DOT FILES] crawler .env, .git, .config, etc.	Bad Web Bot Web App Attack
🇬🇧 martenmark	2026-06-06 14:07:21 (2 weeks ago)	104.207.54.147 - - [06/Jun/2026:14:07:20 +0000] "GET http://www.beapp.co/.svn/wc.db HTTP/1.1" 301 67 ... show more 104.207.54.147 - - [06/Jun/2026:14:07:20 +0000] "GET http://www.beapp.co/.svn/wc.db HTTP/1.1" 301 671 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇨🇳 ThreatBook.io	2026-05-05 22:10:04 (1 month ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.54.147 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.54.147 2026-05-05 01:34:28 / show less	Web App Attack
🇪🇸 Gem	2026-02-13 23:19:51 (4 months ago)	Unauthorized web scan.	Web App Attack
🇺🇸 TPI-Abuse	2026-02-12 02:19:54 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 21:19:49.253789 2026] [security2:error] [pid 24508:tid 24508] [client 104.207.54.147:54597] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1214productions.com"] [uri "/app/.env"] [unique_id "aY04xeH3CfAGWAC4E6dDvwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-11 19:49:14 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 14:49:07.511522 2026] [security2:error] [pid 573800:tid 573800] [client 104.207.54.147:9375] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "archief.org"] [uri "/config/.env"] [unique_id "aYzdM6sLjBYzvzf-U0UL5gAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 Valhalla	2026-02-11 19:22:00 (4 months ago)	/v2/.git/config	Hacking Web App Attack
🇳🇱 homeshowdomain.nl	2026-02-09 23:00:01 (4 months ago)	Auto-ban: >3000 req/min op 2026-02-09	Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2026-02-09 22:03:38 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:03:32.531391 2026] [security2:error] [pid 314193:tid 314193] [client 104.207.54.147:50031] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kathiekate.com"] [uri "/site/.git/config"] [unique_id "aYpZtMBzDMJhq7Ih5l1hgQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 myagent.site	2026-02-09 21:08:16 (4 months ago)	Blocking for trying to access an exploit file: /backup/.git/config	Hacking
Anonymous	2026-01-05 20:22:48 (5 months ago)	Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
🇮🇹 VHosting	2025-12-24 00:55:20 (5 months ago)	Detected attack and reported by a human	DDoS Attack Brute-Force Bad Web Bot Exploited Host Web App Attack SSH
🇫🇮 kumiko	2025-11-25 20:09:07 (6 months ago)	[2025-11-25 22:09:07] Probing for dotfiles "GET /.env HTTP/1.1" 301	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:56:23 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:56:17.632751 2025] [security2:error] [pid 10722:tid 10722] [client 104.207.54.147:24157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.myitalianlife.org"] [uri "/.git/HEAD"] [unique_id "aSU28SNuH_4_dyEYP3oS2wAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 158 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 193.46.255.86

🇨🇱 181.43.200.233

🇻🇳 171.244.141.86

🇰🇷 1.238.106.229

🇦🇷 181.209.96.107

🇩🇪 158.94.208.36

🇻🇳 116.99.49.208

🇮🇳 106.220.62.136

🇦🇲 91.103.250.168

🇸🇾 212.68.59.61

🇪🇨 205.235.2.176

🇿🇦 197.90.195.53

🇹🇷 178.243.57.240

🇮🇩 103.166.122.206

🇺🇸 103.143.11.150

🇳🇱 45.148.10.152

🇺🇸 216.26.125.244

🇹🇭 184.22.38.170

🇫🇮 147.185.133.192

🇫🇷 85.217.140.42