JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.56.238

104.207.56.238 was found in our database!

This IP was reported 131 times. Confidence of Abuse is 2%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.56.238

Whois 104.207.56.238

IP Abuse Reports for 104.207.56.238:

This IP address has been reported a total of 131 times from 13 distinct sources. 104.207.56.238 was first reported on June 4th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 PeravixGroup	2026-05-25 13:11:44 (2 weeks ago)	Honeypot detection: FTP brute-force or anonymous access attempt on port 21. Severity: MEDIUM. Aaran. ... show more Honeypot detection: FTP brute-force or anonymous access attempt on port 21. Severity: MEDIUM. Aaran.cloud show less	FTP Brute-Force Brute-Force
Anonymous	2026-02-10 04:31:15 (4 months ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇺🇸 TPI-Abuse	2026-02-10 04:01:00 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:00:56.052309 2026] [security2:error] [pid 29914:tid 29914] [client 104.207.56.238:16047] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "icbsmonitor.net"] [uri "/.env.production"] [unique_id "aYqteMR6aDd-g_yeRJsIQAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 01:21:19 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 20:21:11.776665 2026] [security2:error] [pid 19019:tid 19019] [client 104.207.56.238:62111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kh6jim.com"] [uri "/v2/.git/config"] [unique_id "aYqIB9AgigDBpBzMjYrK6QAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 23:42:36 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 18:42:30.033754 2026] [security2:error] [pid 10135:tid 10135] [client 104.207.56.238:14831] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kelting.net"] [uri "/frontend/.env"] [unique_id "aYpw5r7X4rEHSMUH0pkvYQAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 22:55:46 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:55:42.427639 2026] [security2:error] [pid 21675:tid 21675] [client 104.207.56.238:35579] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kcmastercleaners.com"] [uri "/backend/.env"] [unique_id "aYpl7uvNq-8dnrmi76_b5gAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 20:16:29 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 15:16:21.935908 2026] [security2:error] [pid 12822:tid 12822] [client 104.207.56.238:20321] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hometechllc.com"] [uri "/config/.env"] [unique_id "aYpAlVt8PM-a5Py3-UeG3AAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-30 02:16:46 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 21:16:42.307990 2026] [security2:error] [pid 1819059:tid 1819059] [client 104.207.56.238:23479] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jolankagroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXwUisbjibsXtpw2h1dxwAAAAA8"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-05 20:17:21 (5 months ago)	Attempted brute force login to web vpn 18 time(s); last attempt for 2026.01.05 is noted in report ti ... show more Attempted brute force login to web vpn 18 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-21 23:36:05 (5 months ago)	Attempted brute force login to web vpn 182 time(s); last attempt for 2025.12.21 is noted in report t ... show more Attempted brute force login to web vpn 182 time(s); last attempt for 2025.12.21 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-19 20:29:12 (5 months ago)	Attempted brute force login to web vpn 145 time(s); last attempt for 2025.12.19 is noted in report t ... show more Attempted brute force login to web vpn 145 time(s); last attempt for 2025.12.19 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-11-24 07:47:37 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:47:33.081252 2025] [security2:error] [pid 21301:tid 21301] [client 104.207.56.238:53489] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "store.drjaymissdiana.com"] [uri "/.env"] [unique_id "aSQNlRHcFs-7-Kq5A7y6gAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:56:07 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.238 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:56:01.469114 2025] [security2:error] [pid 8396:tid 8396] [client 104.207.56.238:21177] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.joe.hatfulofrain.com"] [uri "/.env"] [unique_id "aSPzcXhpK3aZyCYyN6Jd0AAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Rosh	2025-10-17 21:45:05 (7 months ago)	[10/17/25 23:45:05] SSH: illegal login attempts	Brute-Force SSH
🇩🇪 Ad Ministrator	2025-10-15 00:35:18 (7 months ago)	RdpGuard detected brute-force attempt on RD-WEB	Brute-Force

Showing 1 to 15 of 131 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 195.96.139.175

🇸🇬 194.5.82.143

🇧🇷 170.80.65.140

🇨🇳 106.13.10.111

🇬🇧 101.36.97.74

🇷🇺 78.36.41.213

🇳🇱 34.91.82.12

🇨🇦 20.104.72.147

🇷🇴 2.57.121.25

🇦🇪 195.229.76.26

🇲🇾 182.62.24.202

🇩🇪 176.65.132.22

🇦🇷 168.197.250.14

🇻🇳 103.195.236.35

🇨🇳 59.52.178.11

🇭🇰 223.197.186.7

🇪🇸 172.233.96.208

🇮🇳 152.59.36.193

🇮🇪 109.77.21.5

🇸🇬 101.47.156.170