JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.56.199

104.207.56.199 was found in our database!

This IP was reported 136 times. Confidence of Abuse is 9%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.56.199

Whois 104.207.56.199

IP Abuse Reports for 104.207.56.199:

This IP address has been reported a total of 136 times from 17 distinct sources. 104.207.56.199 was first reported on June 4th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-05-20 22:01:39 (2 weeks ago)	Auto-ban: >3000 req/min op 2026-05-20	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-04-28 13:37:32 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 104.207.56.199 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 104.207.56.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 09:37:27.166432 2026] [security2:error] [pid 918:tid 918] [client 104.207.56.199:39383] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|blacktvnow.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blacktvnow.com"] [uri "/s3cmd.ini"] [unique_id "afC4F82AvjuAtiNVM8BHagAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-06 04:30:39 (3 months ago)	(mod_security) mod_security (id:211190) triggered by 104.207.56.199 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211190) triggered by 104.207.56.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 23:30:28.763708 2026] [security2:error] [pid 12498:tid 12498] [client 104.207.56.199:22759] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|yerevanpress.am\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /api/v1/download?path=../../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yerevanpress.am"] [uri "/api/v1/download"] [unique_id "aapYZNUZ18St_oGmvaijqgAAABQ"], referer: http://yerevanpress.am/api/v1/download?path=../../../../../../../../../../etc/passwd show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-05 08:26:28 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.199 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 05 03:26:22.245900 2026] [security2:error] [pid 5953:tid 6047] [client 104.207.56.199:60121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.howardhallis.com"] [uri "/.git/objects/00/4391792cbab589fc4987b6792201e8c868627e"] [unique_id "aak-Lu9_LUubsM0EwzySBQAAAdc"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 [email protected]	2026-03-04 00:26:30 (3 months ago)	104.207.56.199 - - [04/Mar/2026:00:24:37 +0000] "GET /.git/objects/af/05a7a34fec5869c952a4b492a1849b ... show more 104.207.56.199 - - [04/Mar/2026:00:24:37 +0000] "GET /.git/objects/af/05a7a34fec5869c952a4b492a1849b76b6cd2b HTTP/1.1" 404 332 "http://academy.scotland-excel.org.uk/.git/objects/af/05a7a34fec5869c952a4b492a1849b76b6cd2b" "Go-http-client/1.1" 104.207.56.199 - - [04/Mar/2026:00:26:05 +0000] "GET /.git/objects/f6/b943ce49ff63eebc5d0ceff205929e609ee844 HTTP/1.1" 404 332 "http://academy.scotland-excel.org.uk/.git/objects/f6/b943ce49ff63eebc5d0ceff205929e609ee844" "Go-http-client/1.1" 104.207.56.199 - - [04/Mar/2026:00:26:29 +0000] "GET /.git/objects/df/0729c1fb9e11d9ce356cbeb11534dd4f812e20 HTTP/1.1" 404 332 "http://academy.scotland-excel.org.uk/.git/objects/df/0729c1fb9e11d9ce356cbeb11534dd4f812e20" "Go-http-client/1.1" ... show less	Web App Attack
Anonymous	2026-01-05 01:01:37 (5 months ago)	Infected user bad webscan	Exploited Host
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:58 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
Anonymous	2025-11-27 13:43:30 (6 months ago)	Attempted brute force login to web vpn 2203 time(s); last attempt for 2025.11.27 is noted in report ... show more Attempted brute force login to web vpn 2203 time(s); last attempt for 2025.11.27 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-18 23:29:41 (6 months ago)	Attempted brute force login to web vpn 324 time(s); last attempt for 2025.11.18 is noted in report t ... show more Attempted brute force login to web vpn 324 time(s); last attempt for 2025.11.18 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-05 03:17:26 (7 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-10-10 20:26:09 (7 months ago)	Attempted brute force login to web vpn 126 time(s); last attempt for 2025.10.10 is noted in report t ... show more Attempted brute force login to web vpn 126 time(s); last attempt for 2025.10.10 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-09 20:39:13 (7 months ago)	Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.09 is noted in report ti ... show more Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.09 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-08 21:07:51 (7 months ago)	Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.08 is noted in report ti ... show more Attempted brute force login to web vpn 72 time(s); last attempt for 2025.10.08 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-07 08:08:46 (1 year ago)	Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.07 is noted in report tim ... show more Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.07 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-04-05 23:10:46 (1 year ago)	Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.05 is noted in report tim ... show more Attempted brute force login to web vpn 3 time(s); last attempt for 2025.04.05 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 136 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 203.175.125.130

🇪🇹 196.189.155.89

🇦🇷 186.122.177.140

🇲🇾 49.124.153.29

🇭🇰 43.240.13.47

🇻🇳 14.225.173.146

🇩🇪 207.154.246.229

🇹🇷 188.59.178.30

🇨🇳 123.184.59.71

🇺🇸 104.243.42.167

🇫🇮 80.223.190.179

🇬🇧 5.183.102.11

🇩🇪 213.209.159.231

🇪🇹 196.188.116.56

🇺🇸 146.190.134.221

🇻🇳 116.110.156.108

🇮🇳 103.252.168.4

🇷🇴 80.94.92.168

🇩🇪 185.91.127.85

🇺🇸 147.185.132.101