JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.219.236.100

104.219.236.100 was found in our database!

This IP was reported 1,106 times. Confidence of Abuse is 61%: ?

61%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	DataWagon LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS27176
Hostname(s)	ip-104-219-236-100.host.datawagon.net
Domain Name	datawagon.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.219.236.100

Whois 104.219.236.100

IP Abuse Reports for 104.219.236.100:

This IP address has been reported a total of 1,106 times from 360 distinct sources. 104.219.236.100 was first reported on January 4th 2022, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 masterguru	2026-07-24 00:35:03 (2 hours ago)	(wplogin) Failed WordPress login from 104.219.236.100 (US/United States/ip-104-219-236-100.host.data ... show more (wplogin) Failed WordPress login from 104.219.236.100 (US/United States/ip-104-219-236-100.host.datawagon.net): 5 in the last 3600 secs (0-122) show less	Hacking
🇮🇩 securejdprop	2026-07-23 08:15:19 (18 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 3). show less	Hacking Web App Attack
🇸🇬 securejdprop	2026-07-22 06:40:59 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 3). show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 01:31:14 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawa ... show more (mod_security) mod_security (id:225170) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawagon.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 21:31:06.541023 2026] [security2:error] [pid 3692103:tid 3692103] [client 104.219.236.100:59466] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|eftekharschool.ir\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eftekharschool.ir"] [uri "/wp-json/wp/v2/users"] [unique_id "amAdWuNNn4zIkYkNPhlZ-QAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 11:19:11 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawa ... show more (mod_security) mod_security (id:240335) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawagon.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 07:19:07.729146 2026] [security2:error] [pid 6242:tid 6242] [client 104.219.236.100:55482] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.219.236.100 (+1 hits since last alert)\|tttns.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "tttns.com"] [uri "/xmlrpc.php"] [unique_id "al4EK5urHf5BOTBT-VRnpQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-07-19 18:28:39 (4 days ago)	http:scan	Brute-Force Web App Attack
🇬🇧 oncord	2026-07-19 12:07:07 (4 days ago)	Form spam	Web Spam
🇺🇸 convos	2026-07-17 18:27:05 (6 days ago)	Auto-blocked by IT Solutions USA security proxy after malicious web-shell/backdoor scanning and atta ... show more Auto-blocked by IT Solutions USA security proxy after malicious web-shell/backdoor scanning and attack probes. Requests blocked (403). show less	Web App Attack Hacking Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-13 11:55:58 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawa ... show more (mod_security) mod_security (id:210492) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawagon.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 07:55:53.481144 2026] [security2:error] [pid 456:tid 456] [client 104.219.236.100:44918] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.criarteste.com"] [uri "/.git/config"] [unique_id "alTSSVUV6ewXENny52BhZgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 oncord	2026-07-07 04:40:25 (2 weeks ago)	Form spam	Web Spam
🇩🇪 raph	2026-07-06 08:52:06 (2 weeks ago)	[SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%2 ... show more [SQL INJECTION] f2b match %{+Q}r for ^.haproxy\[[0-9]+\]: <HOST>:. (GET \|POST ).\?.(%20AND%20\|%20and%20\|%20OR%20\|%20or%20).* HTTP/1.1$ show less	SQL Injection
🇺🇸 TPI-Abuse	2026-07-06 00:02:28 (2 weeks ago)	(mod_security) mod_security (id:211220) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawa ... show more (mod_security) mod_security (id:211220) triggered by 104.219.236.100 (ip-104-219-236-100.host.datawagon.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 20:02:21.461569 2026] [security2:error] [pid 1787:tid 1787] [client 104.219.236.100:50778] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|8070tas.consorciolegal.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "8070tas.consorciolegal.com"] [uri "/index.php"] [unique_id "akrwjTriaHkCP_mHMWuWoQAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 securejdprop	2026-07-05 12:39:46 (2 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 3). Ip 104.219.236.100 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-07-05 12:39:45.72810972 +0000 UTC show less	Hacking Web App Attack
🇩🇪 maxpower	2026-06-30 22:54:15 (3 weeks ago)	(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 104.219.236.100 (US/United States/ip-104-219-2 ... show more (wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 104.219.236.100 (US/United States/ip-104-219-236-100.host.datawagon.net): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.219.236.100 - - [01/Jul/2026:00:54:08 +0200] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 301 305 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" "-" host=deflorentiis.com 104.219.236.100 - - [01/Jul/2026:00:54:12 +0200] "GET /wp-json/wp/v2/users?per_page=100 HTTP/1.1" 200 7573 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" "-" host=deflorentiis.com 104.219.236.100 - - [01/Jul/2026:00:54:12 +0200] "GET /wp-json/wp/v2/users HTTP/1.1" 301 292 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" "-" host=deflorentiis.com show less	Port Scan
🇩🇪 big-cloud.nl	2026-06-27 16:52:04 (3 weeks ago)	Try to access /xmlrpc.php?rsd	Web App Attack

Showing 1 to 15 of 1106 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 165.22.41.116

🇳🇱 89.21.67.139

🇧🇪 198.235.24.182

🇺🇸 198.98.62.211

🇮🇩 182.253.194.24

🇷🇺 178.178.194.128

🇵🇰 175.107.32.186

🇳🇱 77.83.39.14

🇺🇸 66.132.195.90

🇺🇸 66.132.195.87

🇺🇸 64.62.197.173

🇮🇪 54.171.154.55

🇺🇸 47.90.198.19

🇧🇷 45.205.1.243

🇧🇷 45.157.156.222

🇺🇸 20.124.91.101

🇬🇧 5.252.83.244

🇧🇪 198.235.24.133

🇷🇴 193.32.162.42

🇮🇶 138.124.158.150