JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.207.63.120

104.207.63.120 was found in our database!

This IP was reported 136 times. Confidence of Abuse is 20%: ?

20%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.207.63.120

Whois 104.207.63.120

IP Abuse Reports for 104.207.63.120:

This IP address has been reported a total of 136 times from 19 distinct sources. 104.207.63.120 was first reported on June 21st 2024, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 drewf.ink	2026-09-02 09:45:33 (15 hours ago)	[09:45] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [09:45] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇺🇸 drewf.ink	2026-09-01 03:27:56 (1 day ago)	[03:27] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gatew ... show more [03:27] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon) show less	Web App Attack
🇺🇦 URAN Publishing Service	2026-08-26 17:18:45 (1 week ago)	[26/Aug/2026:20:18:45 +0300] -- 104.207.63.120 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET ... show more [26/Aug/2026:20:18:45 +0300] -- 104.207.63.120 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET http://visnyk-history.knlu.edu.ua/sitemap.xml.gz HTTP/1.1 show less	Bad Web Bot Web App Attack
🇫🇷 Sklurk	2026-08-04 02:10:06 (4 weeks ago)	Web App Attack	Web App Attack
🇳🇱 Mangelot Hosting	2026-05-07 21:32:52 (3 months ago)	(bad_user_agent) srv102 Bad User-Agent 104.207.63.120 (FR/France/-): 10 in the last 3600 secs; Ports ... show more (bad_user_agent) srv102 Bad User-Agent 104.207.63.120 (FR/France/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇳🇱 TCATERDSBE	2026-03-19 09:47:00 (5 months ago)	SQL Injection	SQL Injection
🇺🇸 TPI-Abuse	2025-11-25 02:58:42 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:58:39.261078 2025] [security2:error] [pid 32239:tid 32239] [client 104.207.63.120:21641] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dbfitwell.com"] [uri "/.git/HEAD"] [unique_id "aSUbX-fcVGfHxRusqypEMgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 07:19:53 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:19:45.712707 2025] [security2:error] [pid 10696:tid 10825] [client 104.207.63.120:25079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.crowns.org"] [uri "/.env"] [unique_id "aSQHESJafRnFKTiRlopOFgAAAVE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 06:24:55 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:24:35.026949 2025] [security2:error] [pid 6747:tid 6747] [client 104.207.63.120:14351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.isleofcain.com"] [uri "/.svn/wc.db"] [unique_id "aSP6I7u30aKInR5XM9BvnAAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:59:57 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:58:57.392604 2025] [security2:error] [pid 3320988:tid 3320988] [client 104.207.63.120:50495] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.taacorp.com"] [uri "/.git/HEAD"] [unique_id "aSPmEXTeEa4U3xWoKzZuuQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-24 04:09:00 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:08:54.490447 2025] [security2:error] [pid 12253:tid 12253] [client 104.207.63.120:26497] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.lisarlee.com"] [uri "/.env"] [unique_id "aSPaVk8sFHYALhILkyR5JwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nowyouknow	2025-11-10 08:55:40 (9 months ago)	(From [email protected]) World's FIRST AI System That Creates PROFITABLE Amazon Books In ... show more (From [email protected]) World's FIRST AI System That Creates PROFITABLE Amazon Books In Under 6 Minutes Across 25+ Niches https://goldsolutions.pro/RoyaltyProfitsAI to UNSUBSCRIBE: https://goldsolutions.pro/unsubscribe?domain=fordfamilychiropractic.net Address: 209 West Street Comstock Park, MI 49321 show less	Phishing Web Spam
🇺🇸 nowyouknow	2025-11-09 04:04:11 (9 months ago)	(From [email protected]) SOFTWARE: New AI Cloud-Tool Quietly Turns Simple Ideas Into Passive ... show more (From [email protected]) SOFTWARE: New AI Cloud-Tool Quietly Turns Simple Ideas Into Passive Royalties.... ...No tech. No product. No audience. Just this one AI tool. https://www.novaai.expert/OhanashiGenAI to UNSUBSCRIBE: https://www.novaai.expert/unsubscribe?domain=tbsportsmedicine.com Address: 209 West Street Comstock Park, MI 49321 show less	Phishing Web Spam
🇺🇸 TPI-Abuse	2025-11-01 12:36:40 (10 months ago)	(mod_security) mod_security (id:210831) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 104.207.63.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 01 08:36:34.672760 2025] [security2:error] [pid 1592:tid 1592] [client 104.207.63.120:18019] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|hotpay.co\|F\|4"] [data "compatible ; MSIE"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "hotpay.co"] [uri "/xmlrpc.php"] [unique_id "aQX-0kf9sJFBRvC8mQ-rJQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-30 15:20:13 (10 months ago)	WordPress Brute Force	Brute-Force

Showing 1 to 15 of 136 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 209.141.46.157

🇺🇸 71.178.119.196

🇧🇷 201.11.249.49

🇳🇱 193.176.31.152

🇫🇮 147.185.133.251

🇩🇪 135.125.235.107

🇫🇷 91.231.89.12

🇺🇸 91.230.168.251

🇫🇷 91.196.152.79

🇬🇧 87.106.65.126

🇨🇳 49.234.192.248

🇺🇸 45.33.109.10

🇬🇧 195.96.139.96

🇬🇧 193.163.125.245

🇲🇽 189.224.96.113

🇺🇸 188.119.119.203

🇺🇦 176.103.15.155

🇦🇷 148.222.222.173

🇷🇺 147.45.153.48

🇨🇳 117.169.193.137