JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.61.139

104.207.61.139 was found in our database!

This IP was reported 131 times. Confidence of Abuse is 19%: ?

19%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.61.139

Whois 104.207.61.139

IP Abuse Reports for 104.207.61.139:

This IP address has been reported a total of 131 times from 16 distinct sources. 104.207.61.139 was first reported on June 7th 2024, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob.fr	2026-06-22 19:16:05 (13 hours ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇦🇺 paulshipley.com.au	2026-06-14 22:18:41 (1 week ago)	[Mon Jun 15 08:18:40.289676 2026] [security2:error] [pid 37598] [client 104.207.61.139:21921] [clien ... show more [Mon Jun 15 08:18:40.289676 2026] [security2:error] [pid 37598] [client 104.207.61.139:21921] [client 104.207.61.139] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/xmlrpc.php"] [unique_id "ai8owNuHjj_3OQyZZmPn9QAAAAA"] ... show less	Web App Attack
🇬🇧 PeravixGroup	2026-05-06 17:55:29 (1 month ago)	Honeypot detection: Kubernetes API unauthorized access / cluster abuse attempt on port 6443. Severit ... show more Honeypot detection: Kubernetes API unauthorized access / cluster abuse attempt on port 6443. Severity: MEDIUM. Aaran.cloud show less	Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-02-11 23:22:11 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 18:22:05.498031 2026] [security2:error] [pid 14219:tid 14272] [client 104.207.61.139:9163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arizonasolutionsgroup.com"] [uri "/.env.local"] [unique_id "aY0PHcZKUA-qF6begiTU2QAAARg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2026-02-11 21:05:15 (4 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 06:01:29 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 10 01:01:25.667378 2026] [security2:error] [pid 18580:tid 18580] [client 104.207.61.139:52643] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "koidivision.com"] [uri "/api/.git/config"] [unique_id "aYrJtWPP_GmvHbwN13jzLQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 04:45:56 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:45:50.681642 2026] [security2:error] [pid 9829:tid 9847] [client 104.207.61.139:40651] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "idealcentralvac.com"] [uri "/.env.local"] [unique_id "aYq3_k2gXiz6axLwsMS_IgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 02:46:51 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:46:43.144802 2026] [security2:error] [pid 9464:tid 9464] [client 104.207.61.139:27929] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "madisonjazzorchestra.com"] [uri "/.git/config"] [unique_id "aYqcE_dZwz7Rm1qXWfKOigAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-10 02:01:33 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 21:01:28.108030 2026] [security2:error] [pid 13252:tid 13252] [client 104.207.61.139:45959] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kidswow.com"] [uri "/config/.env"] [unique_id "aYqReFtFnjq2684-LD_jwwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 22:33:27 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:33:20.197929 2026] [security2:error] [pid 18322:tid 18322] [client 104.207.61.139:57921] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kaylamaclaincounseling.com"] [uri "/.env.save"] [unique_id "aYpgsDbABism-z-HHUEwFQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-09 21:18:50 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 16:18:40.642984 2026] [security2:error] [pid 16937:tid 16937] [client 104.207.61.139:9095] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "horse7.com"] [uri "/backend/.env"] [unique_id "aYpPMJLO6ClnBvkkWgUhvAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-05 20:31:07 (5 months ago)	Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-21 20:03:47 (6 months ago)	Attempted brute force login to web vpn 252 time(s); last attempt for 2025.12.21 is noted in report t ... show more Attempted brute force login to web vpn 252 time(s); last attempt for 2025.12.21 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-19 22:17:51 (6 months ago)	Attempted brute force login to web vpn 180 time(s); last attempt for 2025.12.19 is noted in report t ... show more Attempted brute force login to web vpn 180 time(s); last attempt for 2025.12.19 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-01 23:53:55 (6 months ago)	Attempted brute force login to web vpn 973 time(s); last attempt for 2025.12.01 is noted in report t ... show more Attempted brute force login to web vpn 973 time(s); last attempt for 2025.12.01 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 131 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 186.22.94.70

🇩🇪 185.242.3.173

🇩🇪 167.94.146.41

🇮🇩 163.227.52.50

🇳🇱 160.119.71.135

🇰🇷 112.151.178.49

🇮🇳 103.54.101.248

🇬🇧 88.97.179.129

🇳🇱 85.121.55.219

🇫🇷 81.254.26.190

🇧🇾 81.30.98.142

🇹🇼 60.250.246.239

🇨🇦 216.26.237.50

🇺🇸 207.46.13.6

🇧🇷 205.210.31.207

🇮🇳 182.74.176.182

🇺🇸 162.216.150.199

🇺🇸 162.216.150.116

🇨🇦 138.197.155.83

🇨🇳 115.190.185.14