JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.56.246

104.207.56.246 was found in our database!

This IP was reported 140 times. Confidence of Abuse is 8%: ?

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.56.246

Whois 104.207.56.246

IP Abuse Reports for 104.207.56.246:

This IP address has been reported a total of 140 times from 19 distinct sources. 104.207.56.246 was first reported on June 4th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 evilrave	2026-05-17 01:11:47 (1 month ago)	104.207.56.246 - - [17/May/2026:01:11:46 +0000] "GET http://[REDACTED_IP]/wp-json/gravitysmtp/v1/tes ... show more 104.207.56.246 - - [17/May/2026:01:11:46 +0000] "GET http://[REDACTED_IP]/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 444 0 Host="[REDACTED_IP]" SNI="-" ... show less	Bad Web Bot
Anonymous	2026-05-12 12:55:20 (1 month ago)	2026-05-12T14:55:20.327607+02:00 zanati wp(www.sahpa.co.za)[1914858]: Blocked authentication attempt ... show more 2026-05-12T14:55:20.327607+02:00 zanati wp(www.sahpa.co.za)[1914858]: Blocked authentication attempt for [email protected] from 104.207.56.246 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-20 13:59:35 (4 months ago)	(mod_security) mod_security (id:210350) triggered by 104.207.56.246 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 104.207.56.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 08:59:12.560732 2026] [security2:error] [pid 7049:tid 7049] [client 104.207.56.246:12803] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.oualierealty.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.oualierealty.com"] [uri "/index.php"] [unique_id "aW-KMIfc8hYs4JgnbkOW4QAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2025-12-30 14:03:29 (5 months ago)	tcp/80 (54 or more attempts)	Port Scan
Anonymous	2025-12-22 21:52:46 (5 months ago)	wordpress-trap	Web App Attack
Anonymous	2025-12-21 09:17:53 (5 months ago)	Attempted brute force login to web vpn 126 time(s); last attempt for 2025.12.21 is noted in report t ... show more Attempted brute force login to web vpn 126 time(s); last attempt for 2025.12.21 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-19 23:42:51 (6 months ago)	Attempted brute force login to web vpn 108 time(s); last attempt for 2025.12.19 is noted in report t ... show more Attempted brute force login to web vpn 108 time(s); last attempt for 2025.12.19 is noted in report timestamp show less	Hacking Brute-Force
🇳🇱 Mangelot Hosting	2025-12-19 12:00:30 (6 months ago)	(php_susp_dir) srv102 PHP in suspicious dir 104.207.56.246 (DE/Germany/-): 1 in the last 3600 secs; ... show more (php_susp_dir) srv102 PHP in suspicious dir 104.207.56.246 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇦🇺 MAGIC	2025-12-15 02:02:12 (6 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Anonymous	2025-12-01 23:12:09 (6 months ago)	Attempted brute force login to web vpn 943 time(s); last attempt for 2025.12.01 is noted in report t ... show more Attempted brute force login to web vpn 943 time(s); last attempt for 2025.12.01 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-30 23:00:50 (6 months ago)	Attempted brute force login to web vpn 936 time(s); last attempt for 2025.11.30 is noted in report t ... show more Attempted brute force login to web vpn 936 time(s); last attempt for 2025.11.30 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-27 23:23:17 (6 months ago)	Attempted brute force login to web vpn 2532 time(s); last attempt for 2025.11.27 is noted in report ... show more Attempted brute force login to web vpn 2532 time(s); last attempt for 2025.11.27 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-11-27 21:45:45 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.246 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:45:40.780973 2025] [security2:error] [pid 27290:tid 27290] [client 104.207.56.246:18117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftiptondds.com"] [uri "/.env"] [unique_id "aSjGhEYauYgGleFA4z4gZgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-27 19:32:16 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.56.246 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.56.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 14:31:57.539364 2025] [security2:error] [pid 32548:tid 32548] [client 104.207.56.246:27717] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "avvmarchetticollini.it"] [uri "/.git/HEAD"] [unique_id "aSinLeZf6_vVglBwqdJoAgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2025-11-25 23:04:47 (6 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2025-11-24. show less	Hacking Web App Attack SSH

Showing 1 to 15 of 140 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.11

🇺🇸 205.210.31.43

🇮🇳 182.70.255.242

🇷🇺 178.45.189.116

🇺🇸 148.153.32.63

🇨🇳 120.227.224.157

🇻🇳 103.167.89.178

🇺🇸 50.31.205.8

🇺🇸 45.156.129.80

🇩🇪 45.135.193.193

🇺🇸 3.238.178.195

🇪🇸 185.74.240.219

🇻🇳 183.91.11.36

🇺🇸 162.216.150.87

🇺🇸 162.216.150.39

🇺🇸 162.216.150.31

🇷🇺 156.229.16.165

🇺🇸 108.24.168.68

🇲🇾 103.253.105.16

🇫🇮 46.62.217.123