JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.54.178

104.207.54.178 was found in our database!

This IP was reported 148 times. Confidence of Abuse is 33%: ?

33%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.54.178

Whois 104.207.54.178

IP Abuse Reports for 104.207.54.178:

This IP address has been reported a total of 148 times from 21 distinct sources. 104.207.54.178 was first reported on June 22nd 2024, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-07-10 04:16:33 (3 hours ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇪🇸 SweetHoneyPress	2026-07-09 18:53:11 (12 hours ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1015166 \| UA: Mozilla/5.0 (Macintosh; Intel Mac O ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=1015166 \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15 show less	Web App Attack Brute-Force
🇫🇷 Sklurk	2026-07-09 01:26:22 (1 day ago)	Web App Attack	Web App Attack
🇩🇪 london2038.com	2026-07-09 01:09:10 (1 day ago)	Attacking WordPress 104.207.54.178 - - [09/Jul/2026:03:09:06 +0200] "POST /xmlrpc.php HTTP/1.1" 503 ... show more Attacking WordPress 104.207.54.178 - - [09/Jul/2026:03:09:06 +0200] "POST /xmlrpc.php HTTP/1.1" 503 18963 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack
🇫🇷 Sklurk	2026-07-08 01:02:43 (2 days ago)	Web App Attack	Web App Attack
🇩🇪 Hazzard	2026-05-23 17:11:37 (1 month ago)	(wordpress) Failed wordpress login from 104.207.54.178 (DE/Germany/State of Berlin/Berlin/-/[redacte ... show more (wordpress) Failed wordpress login from 104.207.54.178 (DE/Germany/State of Berlin/Berlin/-/[redacted]): (CF_ENABLE) show less	Brute-Force
🇩🇪 conseilgouz	2026-04-02 02:44:57 (3 months ago)	avw-(visforms) : try to access forms...	Hacking
🇦🇺 MAGIC	2026-01-09 00:08:31 (6 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2025-12-08 18:27:44 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 13:27:38.515471 2025] [security2:error] [pid 2754:tid 2754] [client 104.207.54.178:29617] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caddydad.com"] [uri "/.git/HEAD"] [unique_id "aTcYmhr5unNjVMKQzGA7CwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-08 01:33:53 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 20:33:46.969344 2025] [security2:error] [pid 902:tid 909] [client 104.207.54.178:43069] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yubasutterphotography.com"] [uri "/.git/HEAD"] [unique_id "aTYq-r71iYNayHGevDZvjgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-12-07 21:18:55 (7 months ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇳🇱 jjnxpct	2025-12-07 04:54:45 (7 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /.aws/credentials (Rule ID: 930130) - Restricted File Access Attempt show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-12-05 04:17:44 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 23:17:36.720325 2025] [security2:error] [pid 16393:tid 16393] [client 104.207.54.178:20605] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "justmakingitbetter.com"] [uri "/.svn/wc.db"] [unique_id "aTJc4HBlhyz19lJ-QCI-OwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-27 13:37:58 (7 months ago)	Attempted brute force login to web vpn 1188 time(s); last attempt for 2025.11.27 is noted in report ... show more Attempted brute force login to web vpn 1188 time(s); last attempt for 2025.11.27 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-11-27 10:43:08 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.178 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 05:43:02.427177 2025] [security2:error] [pid 6532:tid 6532] [client 104.207.54.178:12767] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.johneiden.com"] [uri "/.svn/wc.db"] [unique_id "aSgrNs5IWCmVlIZ-XQWu0wAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 148 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 217.150.195.162

🇺🇸 198.46.138.41

🇺🇸 195.184.76.148

🇺🇸 195.184.76.85

🇵🇱 194.180.49.70

🇺🇸 165.154.135.73

🇮🇩 163.7.11.126

🇨🇳 150.255.92.208

🇺🇸 147.185.132.152

🇵🇰 110.93.224.226

🇮🇳 106.213.86.90

🇬🇭 102.223.92.101

🇸🇮 102.220.160.47

🇰🇪 102.210.148.92

🇨🇳 101.96.220.237

🇮🇹 93.148.108.95

🇫🇷 91.231.89.71

🇨🇦 85.217.149.40

🇱🇹 62.60.130.219

🇮🇳 61.1.174.133