JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.62.118

104.207.62.118 was found in our database!

This IP was reported 134 times. Confidence of Abuse is 20%: ?

20%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.62.118

Whois 104.207.62.118

IP Abuse Reports for 104.207.62.118:

This IP address has been reported a total of 134 times from 16 distinct sources. 104.207.62.118 was first reported on June 5th 2024, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob.fr	2026-06-14 19:15:28 (5 days ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-10 18:50:27 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 14:50:20.697749 2026] [security2:error] [pid 2334:tid 2334] [client 104.207.62.118:58741] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jerusalem-korczak-home.com"] [uri "/.svn/wc.db"] [unique_id "aimx7JjOZ4c4TAH1Osv2jgAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-25 11:44:27 (3 weeks ago)	[osotir.org] httpd-login-spray-site: sites=agonistes.gr.synathlountes; logs=/var/log/httpd/domains/a ... show more [osotir.org] httpd-login-spray-site: sites=agonistes.gr.synathlountes; logs=/var/log/httpd/domains/agonistes.gr.synathlountes.log; samples=site_wide=true \| distinct_ips=26 \| /wp-login.php show less	Hacking Web App Attack
🇦🇺 RedBear IT	2026-03-26 10:00:37 (2 months ago)	"DDoS against public endpoint"	DDoS Attack
Anonymous	2026-01-05 20:24:06 (5 months ago)	Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report tim ... show more Attempted brute force login to web vpn 9 time(s); last attempt for 2026.01.05 is noted in report timestamp show less	Hacking Brute-Force
🇱🇹 NotACaptcha	2025-12-30 20:14:25 (5 months ago)	webserver:80 [30/Dec/2025] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x ... show more webserver:80 [30/Dec/2025] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 06:14:12 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 01:14:08.897544 2025] [security2:error] [pid 2660271:tid 2660281] [client 104.207.62.118:35157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bacacup.com"] [uri "/.env"] [unique_id "aVIcMLy5r8TcoL1xTBgEaAAAAEg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 05:01:47 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 00:01:41.797832 2025] [security2:error] [pid 17996:tid 17996] [client 104.207.62.118:15975] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marlinlee.com"] [uri "/.env"] [unique_id "aVILNbrr4xRXHempVeki9gAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-12-21 11:51:55 (5 months ago)	Attempted brute force login to web vpn 180 time(s); last attempt for 2025.12.21 is noted in report t ... show more Attempted brute force login to web vpn 180 time(s); last attempt for 2025.12.21 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-12-19 23:51:17 (5 months ago)	Attempted brute force login to web vpn 127 time(s); last attempt for 2025.12.19 is noted in report t ... show more Attempted brute force login to web vpn 127 time(s); last attempt for 2025.12.19 is noted in report timestamp show less	Hacking Brute-Force
🇺🇸 TPI-Abuse	2025-12-10 14:52:11 (6 months ago)	"Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized ac ... show more "Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized access" show less	DDoS Attack SQL Injection Exploited Host
🇬🇧 myintarweb	2025-12-04 11:56:24 (6 months ago)	104.207.62.118 - - [04/Dec/2025:11:56:23 +0000] 80 "GET /.git/HEAD HTTP/1.1" 301 1675 "-" "Mozilla/5 ... show more 104.207.62.118 - - [04/Dec/2025:11:56:23 +0000] 80 "GET /.git/HEAD HTTP/1.1" 301 1675 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0" ... show less	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 11:58:30 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 06:58:24.288144 2025] [security2:error] [pid 5240:tid 5240] [client 104.207.62.118:59635] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anniversarymatchbooks.com"] [uri "/.env"] [unique_id "aS7UYPdbLPsm5zwvKeP6TAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 04:15:11 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 23:15:01.449486 2025] [security2:error] [pid 18439:tid 18439] [client 104.207.62.118:51975] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thepercussionworks.com"] [uri "/.env"] [unique_id "aS5nxd5LgtoLNU703vXtjgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-02 03:56:18 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.62.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 22:56:10.216489 2025] [security2:error] [pid 24261:tid 24261] [client 104.207.62.118:34573] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "majesticsolutions.co"] [uri "/.git/HEAD"] [unique_id "aS5jWmwIWZETIfIIbr6C7AAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 134 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 125.142.37.91

🇮🇷 85.198.19.251

🇰🇷 59.12.160.91

🇩🇪 43.157.98.118

🇺🇸 2607:f8b0:4023:1006::124

🇻🇳 202.158.244.203

🇨🇦 198.27.81.190

🇧🇷 179.146.44.138

🇺🇸 172.233.237.244

🇺🇸 167.71.22.65

🇺🇸 152.32.183.31

🇨🇳 119.123.31.23

🇭🇺 109.61.12.110

🇳🇱 45.148.10.147

🇺🇸 44.118.228.22

🇺🇸 44.92.130.51

🇰🇷 14.206.12.13

🇲🇾 202.165.15.132

🇸🇬 194.164.107.4

🇩🇪 185.242.3.195