JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.61.49

104.207.61.49 was found in our database!

This IP was reported 127 times. Confidence of Abuse is 20%: ?

20%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.61.49

Whois 104.207.61.49

IP Abuse Reports for 104.207.61.49:

This IP address has been reported a total of 127 times from 19 distinct sources. 104.207.61.49 was first reported on June 13th 2024, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ELYAZ	2026-05-31 07:50:07 (5 days ago)	(y4) Failed scan -byebye- from 104.207.61.49 (CA/Canada/-): (CF_ENABLE)	Hacking
Anonymous	2026-05-28 13:17:59 (1 week ago)	[ns31.kdns.gr] httpd-login-spray-site: sites=ceramics-menegis.gr; logs=/var/log/httpd/domains/cerami ... show more [ns31.kdns.gr] httpd-login-spray-site: sites=ceramics-menegis.gr; logs=/var/log/httpd/domains/ceramics-menegis.gr.log; samples=site_wide=true \| distinct_ips=13 \| /wp-login.php show less	Hacking Web App Attack
🇬🇧 poundawebsiteltd	2026-05-28 05:13:06 (1 week ago)	WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 104.207.61.49 - - [28/May/2026:06:13:03 +0100] P ... show more WP Exploit attempt. Evidence: [REDACTED_DOMAIN]:443 104.207.61.49 - - [28/May/2026:06:13:03 +0100] POST /wp-login.php HTTP/1.1 503 21350 https://[REDACTED_DOMAIN]/wp-login.php Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0 show less	Web App Attack
Anonymous	2026-01-05 20:12:47 (4 months ago)	Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
🇩🇪 HandyTreff.de	2025-12-27 07:44:08 (5 months ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -45.367 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -45.367 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Cr show less	Bad Web Bot Web App Attack
Anonymous	2025-12-22 20:32:01 (5 months ago)	wordpress-trap	Web App Attack
🇺🇸 Penny Packer	2025-12-19 05:07:49 (5 months ago)	Fail2Ban apache-tripwires	Web App Attack
Anonymous	2025-11-27 13:12:58 (6 months ago)	Attempted brute force login to web vpn 1171 time(s); last attempt for 2025.11.27 is noted in report ... show more Attempted brute force login to web vpn 1171 time(s); last attempt for 2025.11.27 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-11-24 07:01:43 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.49 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:01:38.484691 2025] [security2:error] [pid 952:tid 952] [client 104.207.61.49:11357] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.steamboatrowena.com"] [uri "/.svn/wc.db"] [unique_id "aSQC0oi-qf1lbNIFUzgxzwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 05:05:46 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.49 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:05:41.081609 2025] [security2:error] [pid 12990:tid 12990] [client 104.207.61.49:43375] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.gdpeters.com"] [uri "/.git/HEAD"] [unique_id "aSPnpbtCklF3sxmaenTdsgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:50:23 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.49 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.49 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:50:14.936410 2025] [security2:error] [pid 6109:tid 6109] [client 104.207.61.49:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ralphrichardson.com"] [uri "/.env"] [unique_id "aSPkBocSCW6oONt0mK-NYwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 10dencehispahard SL	2025-11-19 07:16:34 (6 months ago)	WP probing for vulnerabilities	Hacking Exploited Host
Anonymous	2025-11-18 23:41:00 (6 months ago)	Attempted brute force login to web vpn 450 time(s); last attempt for 2025.11.18 is noted in report t ... show more Attempted brute force login to web vpn 450 time(s); last attempt for 2025.11.18 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-11-10 18:34:44 (6 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇩🇪 Marc	2025-10-29 21:00:53 (7 months ago)		Brute-Force

Showing 1 to 15 of 127 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 170.79.19.176

🇵🇱 91.204.154.197

🇨🇳 183.136.248.59

🇷🇺 178.178.222.50

🇵🇰 175.107.36.234

🇦🇪 132.243.121.237

🇮🇩 103.41.247.76

🇮🇱 79.177.135.200

🇬🇧 35.203.210.226

🇷🇺 178.178.194.192

🇵🇭 136.158.58.139

🇨🇳 113.95.137.165

🇳🇵 110.34.30.123

🇺🇸 104.154.247.73

🇮🇩 103.193.178.42

🇮🇶 65.20.163.103

🇺🇸 64.201.94.142

🇸🇬 47.128.54.86

🇺🇸 209.85.222.199

🇷🇺 178.178.194.135