JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.56.128

104.207.56.128 was found in our database!

This IP was reported 128 times. Confidence of Abuse is 13%: ?

13%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.56.128

Whois 104.207.56.128

IP Abuse Reports for 104.207.56.128:

This IP address has been reported a total of 128 times from 13 distinct sources. 104.207.56.128 was first reported on June 5th 2024, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 london2038.com	2026-05-29 14:11:57 (3 weeks ago)	Detected by WP fail2ban 2026-05-29T16:11:55.964217+02:00 wordpress: XML-RPC authentication attempt f ... show more Detected by WP fail2ban 2026-05-29T16:11:55.964217+02:00 wordpress: XML-RPC authentication attempt from 104.207.56.128 show less	Brute-Force Web App Attack
🇮🇪 Jim Keir	2026-05-15 12:54:56 (1 month ago)	2026-05-15 12:54:56 104.207.56.128 File scanning, blocking 104.207.56.128 for 5 minutes	Web App Attack
🇩🇪 big-cloud.nl	2026-04-24 21:13:31 (1 month ago)	Try to access /xmlrpc.php	Web App Attack
🇳🇱 homeshowdomain.nl	2026-02-10 23:00:23 (4 months ago)	Auto-ban: >3000 req/min op 2026-02-10	Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2026-02-10 17:33:59 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 12:33:52.627341 2026] [security2:error] [pid 9067:tid 9067] [client 104.207.56.128:64125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anywheregarden.com"] [uri "/dev/.git/config"] [unique_id "aYtsADsngHTNZZY0guc8-QAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 06:38:07 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 01:38:00.686595 2026] [security2:error] [pid 14756:tid 14756] [client 104.207.56.128:38919] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ilil.net"] [uri "/.env.production"] [unique_id "aYrSSD_DCuaQsGt_EcmtpwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 04:58:55 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:58:50.848105 2026] [security2:error] [pid 2759445:tid 2759445] [client 104.207.56.128:38601] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "idetailingcreatives.com"] [uri "/v2/.git/config"] [unique_id "aYq7CmyOdHC02QRpgsuMFwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 02:14:42 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:14:36.274648 2026] [security2:error] [pid 6842:tid 6842] [client 104.207.56.128:40153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kildarafarms.com"] [uri "/dev/.git/config"] [unique_id "aYqUjDd29mo4VYMHESXE1wAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 00:48:11 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 19:47:59.348652 2026] [security2:error] [pid 24081:tid 24081] [client 104.207.56.128:24215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "keyspring-niseko.com"] [uri "/api/.env"] [unique_id "aYqAP3_eAFOXyMnzSsypmgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 00:30:12 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 19:30:06.597384 2026] [security2:error] [pid 15838:tid 15838] [client 104.207.56.128:18647] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ketsuri.com"] [uri "/.env.local"] [unique_id "aYp8DmOcWvXoBht0Cvy8_QAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 23:28:05 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 18:27:51.229112 2026] [security2:error] [pid 25913:tid 25913] [client 104.207.56.128:37157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "keithbowles.com"] [uri "/.git/config"] [unique_id "aYptd7NQBpkTHqMaTOYytwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-02-09 21:18:30 (4 months ago)	IM360 WAF: Laravel .env file access	Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 20:20:27 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 15:20:18.176772 2026] [security2:error] [pid 24556:tid 24556] [client 104.207.56.128:17985] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "homewaterproofing.com"] [uri "/app/.git/config"] [unique_id "aYpBgnpHZJ9arjpWc2mGSwAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-17 09:49:47 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 04:49:40.782047 2026] [security2:error] [pid 4777:tid 4777] [client 104.207.56.128:24755] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.photonmatrix.com"] [uri "/.env"] [unique_id "aWtbNKOidm00I_hQVx4hNAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2025-11-26 19:38:04 (6 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.56.128 (DE/Germany/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.207.56.128 (DE/Germany/-): 1 in the last 3600 secs show less	Web App Attack

Showing 1 to 15 of 128 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.93.106.153

🇷🇴 141.98.83.240

🇺🇸 74.125.182.89

🇳🇱 52.174.67.71

🇷🇴 2.57.122.177

🇺🇸 147.93.179.147

🇨🇳 119.188.182.154

🇺🇸 72.253.251.3

🇨🇳 61.151.249.194

🇨🇳 60.166.82.203

🇯🇵 8.216.16.145

🇿🇦 105.28.108.165

🇧🇬 79.124.40.138

🇺🇸 47.251.93.227

🇬🇧 45.159.89.15

🇬🇧 35.203.211.185

🇨🇳 8.138.172.28

🇨🇴 190.5.200.98

🇩🇪 139.59.208.49

🇳🇿 121.73.163.178