JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.61.137

104.207.61.137 was found in our database!

This IP was reported 141 times. Confidence of Abuse is 15%: ?

15%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.61.137

Whois 104.207.61.137

IP Abuse Reports for 104.207.61.137:

This IP address has been reported a total of 141 times from 20 distinct sources. 104.207.61.137 was first reported on June 6th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 JimArchon72	2026-06-18 19:05:02 (1 week ago)	2026/06/18 19:04:02 "GET /wp-login.php?action=register HTTP/1.1"	Web App Attack
🇬🇧 PeravixGroup	2026-05-22 13:20:34 (1 month ago)	Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: ME ... show more Honeypot detection: Elasticsearch unauthorized access / data leak attempt on port 9200. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇨🇳 ThreatBook.io	2026-05-14 23:24:51 (1 month ago)	ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.61.13 ... show more ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.61.137 2026-05-14 11:01:04 /druid/index.html show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-19 23:32:47 (2 months ago)	ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.61.137 ... show more ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.61.137 2026-04-19 11:18:28 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%200%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 2026-04-19 11:18:29 /index.php?s=member&c=api&m=checktitle&id=13&title=123&module=news,(SELECT(CASE%20WHEN%201%20THEN%20EXP(5000)%20ELSE%200%20END))%20as%20aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-17 23:22:30 (2 months ago)	ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.61.137 ... show more ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.61.137 2026-04-17 15:01:27 /v2/api-docs 2026-04-17 15:01:26 /prod-api/v2/api-docs 2026-04-17 15:01:28 /swagger/docs/v1 2026-04-17 15:01:28 /api/swagger.json 2026-04-17 15:01:29 /v3/api-docs 2026-04-17 15:01:27 /swagger/v1/swagger.json show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-16 23:08:56 (2 months ago)	ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.61.137 ... show more ThreatBook Intelligence: http_proxy,Gateway more details on https://threatbook.io/ip/104.207.61.137 2026-04-16 14:21:05 /prod-api/v2/api-docs show less	Web App Attack
🇺🇸 windowsforum	2026-03-19 17:50:10 (3 months ago)	Spam bot registration: triggers=timing, js_challenge, inv_honeypot, pow_fail, username=GraigNelso	Web Spam Bad Web Bot
🇨🇳 ThreatBook.io	2026-03-10 23:28:01 (3 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.61.137 2 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.61.137 2026-03-10 04:01:51 /nacos/%23/serviceSync show less	Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 22:28:09 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.137 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 17:28:05.901650 2025] [security2:error] [pid 8598:tid 8598] [client 104.207.61.137:59085] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sittser.com"] [uri "/.env"] [unique_id "aVBddXlrt3Grlg1s8YXAHQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-27 20:32:22 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.137 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 27 15:32:14.932498 2025] [security2:error] [pid 27733:tid 27733] [client 104.207.61.137:27631] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brent23.com"] [uri "/.svn/wc.db"] [unique_id "aVBCTr5InE7hsjmTQOoa1AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2025-12-27 19:02:12 (5 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Hacking Web App Attack
🇩🇪 iNetWorker	2025-12-26 03:30:17 (6 months ago)	trolling for resource vulnerabilities	Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 06:00:23 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.137 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 01:00:10.287314 2025] [security2:error] [pid 19016:tid 19016] [client 104.207.61.137:30787] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "allseniorsolutions.com"] [uri "/.svn/wc.db"] [unique_id "aS6Aakz7kho0F4O9q2HkQAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2025-12-02 00:56:16 (6 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Hacking Web App Attack
🇨🇳 ThreatBook.io	2025-11-28 23:53:36 (6 months ago)	ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.61.13 ... show more ThreatBook Intelligence: http_proxy,vpn_proxy more details on https://threatbook.io/ip/104.207.61.137 2025-11-28 12:36:58 /photo/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack

Showing 1 to 15 of 141 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 103.171.158.89

🇱🇹 62.60.130.219

🇰🇷 58.141.91.2

🇺🇸 216.73.161.205

🇩🇪 195.37.190.93

🇳🇱 176.65.148.215

🇬🇧 176.10.0.177

🇸🇬 172.217.44.213

🇨🇳 123.123.196.140

🇰🇷 118.43.202.68

🇨🇳 116.179.32.104

🇲🇦 81.192.46.29

🇳🇱 45.153.34.186

🇺🇸 32.198.73.232

🇨🇳 223.88.24.17

🇳🇱 217.60.195.229

🇹🇼 198.235.24.122

🇦🇺 20.70.202.123

🇺🇸 193.3.53.4

🇲🇾 172.197.168.21