JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.61.156

104.207.61.156 was found in our database!

This IP was reported 148 times. Confidence of Abuse is 27%: ?

27%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.61.156

Whois 104.207.61.156

IP Abuse Reports for 104.207.61.156:

This IP address has been reported a total of 148 times from 27 distinct sources. 104.207.61.156 was first reported on June 5th 2024, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 big-cloud.nl	2026-07-28 18:17:49 (4 hours ago)	Try to access /xmlrpc.php	Web App Attack
🇪🇸 librebit	2026-06-24 03:25:16 (1 month ago)	Brute force	Brute-Force
🇫🇷 ELYAZ	2026-06-14 00:15:44 (1 month ago)	(y4) Failed scan -byebye- from 104.207.61.156 (CA/Canada/-): (CF_ENABLE)	Hacking
🇬🇧 poundawebsiteltd	2026-06-12 18:13:03 (1 month ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 104.207.61.156 - - [12/Jun/2026:19:12:56 +0100] ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 104.207.61.156 - - [12/Jun/2026:19:12:56 +0100] POST /wp-login.php HTTP/1.1 200 7362 https://[REDACTED_DOMAIN]/wp-login.php Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15 show less	Web App Attack
Anonymous	2026-06-12 14:21:01 (1 month ago)	Web attack blocked by Wordfence on gedichtenlangsdegeul.nl (1 hit). Reported by CRMON.	Web App Attack
🇬🇷 setupgr	2026-06-11 08:43:23 (1 month ago)	(mod_security) mod_security (id:900001) triggered by 104.207.61.156: 1 in the last 86400 secs; Ports ... show more (mod_security) mod_security (id:900001) triggered by 104.207.61.156: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Jun 11 11:43:22.273511 2026] [security2:error] [pid 2066464:tid 2066580] [client 104.207.61.156:48167] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^(www\\\\.)?(pankoskal\\\\.gr\|alloweddomain2\\\\.com)$" against "REQUEST_HEADERS:Host" required. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "74"] [id "900001"] [msg "Blocked WP Login attempt on domain: sea-sound.com"] [severity "CRITICAL"] [tag "security"] [hostname "sea-sound.com"] [uri "/wp-login.php"] [unique_id "aip1KkdtEUnd5Frf7ZTMuAAAAE0"], referer: https://sea-sound.com/wp-login.php show less	Port Scan
🇫🇷 ELYAZ	2026-06-01 15:12:53 (1 month ago)	(y4) Failed scan -byebye- from 104.207.61.156 (CA/Canada/-): (CF_ENABLE)	Hacking
🇩🇪 4server	2026-05-31 11:46:01 (1 month ago)	[SunMay3113:45:56.2406492026][security2:error][pid1108547:tid1108581][client104.207.61.156:0]ModSecu ... show more [SunMay3113:45:56.2406492026][security2:error][pid1108547:tid1108581][client104.207.61.156:0]ModSecurity:Accessdeniedwithcode403$phase1$.Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"vg13.ch\"][uri\"/xmlrpc.php\"][unique_id\"ahwfdFRhDL1mlvqurSJueQAAAAk\"] show less	Port Scan Brute-Force Web App Attack
🇲🇽 octageeks.com	2026-05-30 04:13:40 (1 month ago)	Wordpress malicious attack:[octaflood]	Web App Attack
Anonymous	2026-05-28 19:41:13 (2 months ago)	[server.tmg.gr] httpd-login-spray-site: sites=aidshep2019.gr; logs=/var/log/httpd/domains/aidshep201 ... show more [server.tmg.gr] httpd-login-spray-site: sites=aidshep2019.gr; logs=/var/log/httpd/domains/aidshep2019.gr.log; samples=site_wide=true \| distinct_ips=33 \| /wp-login.php show less	Hacking Web App Attack
🇺🇸 mnsf	2026-02-16 03:05:23 (5 months ago)	Too many Status 40X (11) Scanning/Probing (34)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 12:44:25 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 07:44:20.159743 2026] [security2:error] [pid 26959:tid 26959] [client 104.207.61.156:26991] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "patdavis.org"] [uri "/frontend/.env"] [unique_id "aZG_pKFyC9FJxP7hAIcQYgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-15 11:39:12 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.156 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 06:39:09.582976 2026] [security2:error] [pid 31945:tid 31945] [client 104.207.61.156:64463] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pacepk.com"] [uri "/new/.git/config"] [unique_id "aZGwXanKqZeJ8UzZeI5qMQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-02-15 10:55:50 (5 months ago)	(modsecurity) srv102 ModSecurity 104.207.61.156 (CA/Canada/-): 5 in the last 3600 secs; Ports: ; Di ... show more (modsecurity) srv102 ModSecurity 104.207.61.156 (CA/Canada/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇨🇭 Origon	2026-02-15 06:48:51 (5 months ago)	http-sensitive-files - IP: 104.207.61.156 - time="2026-02-15T07:48:51+01:00" level=info msg="(555f6 ... show more http-sensitive-files - IP: 104.207.61.156 - time="2026-02-15T07:48:51+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 104.207.61.156 (CA/200373) : 4h ban on Ip 104.207.61.156" module=db show less	Web App Attack

Showing 1 to 15 of 148 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 182.253.79.195

🇮🇷 94.184.17.141

🇷🇴 92.118.39.203

🇮🇩 69.5.7.218

🇳🇱 45.198.224.26

🇩🇪 213.209.159.225

🇷🇴 92.118.39.209

🇷🇴 92.118.39.205

🇺🇿 84.54.73.75

🇺🇸 45.131.195.226

🇳🇱 195.178.110.227

🇷🇴 193.32.162.15

🇧🇷 192.141.82.133

🇨🇳 180.76.105.69

🇷🇴 92.118.39.202

🇭🇰 220.246.42.227

🇫🇷 209.242.198.177

🇬🇧 193.176.29.13

🇿🇦 172.253.244.221

🇹🇼 114.35.60.61