JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.61.20

104.207.61.20 was found in our database!

This IP was reported 83 times. Confidence of Abuse is 13%: ?

13%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.61.20

Whois 104.207.61.20

IP Abuse Reports for 104.207.61.20:

This IP address has been reported a total of 83 times from 17 distinct sources. 104.207.61.20 was first reported on June 11th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mnsf	2026-06-09 13:05:18 (2 days ago)	Scanning/Probing (24)	Brute-Force Web App Attack
🇺🇸 nyt	2026-05-27 21:39:00 (2 weeks ago)	WP Config Probe	Web App Attack
🇺🇸 mnsf	2026-05-25 06:05:48 (2 weeks ago)	Scanning/Probing (138) Request Overload (138)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-02-24 08:03:16 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 03:03:11.686357 2026] [security2:error] [pid 13676:tid 13753] [client 104.207.61.20:40835] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "myhoustonplasticsurgery.com.aafm.us"] [uri "/.git/config"] [unique_id "aZ1bP_MyU95gl_pEJFjfPgAAAIc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-23 23:49:54 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 18:49:49.449252 2026] [security2:error] [pid 28933:tid 28933] [client 104.207.61.20:51725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chipnado.fractalsky.com"] [uri "/.git/config"] [unique_id "aZznnfnVvN8W1BF-ImhzwAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-23 15:27:30 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 23 10:27:26.708031 2026] [security2:error] [pid 10132:tid 10132] [client 104.207.61.20:23261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jiggaboojones.indie100.com"] [uri "/.git/config"] [unique_id "aZxx3hau-xi18wfYga9srwAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-18 00:49:15 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 17 19:49:10.149830 2026] [security2:error] [pid 32342:tid 32342] [client 104.207.61.20:57761] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "r-390a.net"] [uri "/.env.production"] [unique_id "aZUMhqqtC9SLc7XAjgmvoQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 mrcrassi	2025-12-08 02:13:25 (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: BLOCK Protocol: HTTP/1.1 (POST meth ... show more Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2025-11-25 06:13:38 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 01:13:32.964798 2025] [security2:error] [pid 19757:tid 19757] [client 104.207.61.20:40599] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "epowersupplyusa.com"] [uri "/.env"] [unique_id "aSVJDI-Zm5jsJU0CLab5pgAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:54:21 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:54:17.933653 2025] [security2:error] [pid 13511:tid 13511] [client 104.207.61.20:34881] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davesullivan.net"] [uri "/.git/HEAD"] [unique_id "aSUaWf0rtJRJtASdmw9QBQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 AWW-Admin	2025-10-16 15:38:14 (7 months ago)	(wordpress) Failed wordpress login from 104.207.61.20 (CA/Canada/-)	Brute-Force
Anonymous	2025-10-11 08:05:55 (8 months ago)	Attempted brute force login to web vpn 54 time(s); last attempt for 2025.10.11 is noted in report ti ... show more Attempted brute force login to web vpn 54 time(s); last attempt for 2025.10.11 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-10 20:37:49 (8 months ago)	Attempted brute force login to web vpn 91 time(s); last attempt for 2025.10.10 is noted in report ti ... show more Attempted brute force login to web vpn 91 time(s); last attempt for 2025.10.10 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-09 20:44:57 (8 months ago)	Attempted brute force login to web vpn 143 time(s); last attempt for 2025.10.09 is noted in report t ... show more Attempted brute force login to web vpn 143 time(s); last attempt for 2025.10.09 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-10-08 21:19:03 (8 months ago)	Attempted brute force login to web vpn 144 time(s); last attempt for 2025.10.08 is noted in report t ... show more Attempted brute force login to web vpn 144 time(s); last attempt for 2025.10.08 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 83 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇱 172.70.200.147

🇰🇪 162.158.231.151

🇳🇴 141.98.253.27

🇺🇸 104.243.35.45

🇳🇱 86.54.31.44

🇳🇱 80.82.77.33

🇧🇳 61.6.206.13

🇮🇪 52.209.195.164

🇺🇸 45.156.129.189

🇳🇱 45.148.10.141

🇪🇸 37.156.188.23

🇫🇮 34.88.178.28

🇷🇴 2.57.121.112

🇺🇸 216.151.138.49

🇺🇸 203.88.119.100

🇳🇱 195.178.110.188

🇦🇿 172.68.75.157

🇺🇸 162.216.149.190

🇺🇸 162.216.149.34

🇺🇸 147.185.132.164