JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.248.203.61

104.248.203.61 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 1%: ?

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.248.203.61

Whois 104.248.203.61

IP Abuse Reports for 104.248.203.61:

This IP address has been reported a total of 26 times from 17 distinct sources. 104.248.203.61 was first reported on April 5th 2024, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 MeduzaCTI	2026-05-10 17:16:45 (3 weeks ago)	Indicator Report Indicator: 104.248.203.61 Reporter: JamesSund Description: Supershell C2 Detected ... show more Indicator Report Indicator: 104.248.203.61 Reporter: JamesSund Description: Supershell C2 Detected Tags: Supershell,Malware,C2 Source: MeduzaCTI Platform Reference: https://meduzacti.com show less	Hacking
🇩🇰 buusbudde.dk	2024-04-26 20:46:43 (2 years ago)	[Fri Apr 26 22:46:43.189044 2024] [security2:error] [pid 2052113] [client 104.248.203.61:64494] [cli ... show more [Fri Apr 26 22:46:43.189044 2024] [security2:error] [pid 2052113] [client 104.248.203.61:64494] [client 104.248.203.61] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "buusbudde.dk"] [uri "/webshell4/login.php"] [unique_id "ZiwSs4PASbk6vpKwDbdmoQAAAAQ"] [Fri Apr 26 22:46:43.201683 2024] [security2:error] [pid 2709663] [client 104.248.203.61:64506] [client 104.248.203.61] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severit ... show less	Web App Attack
Anonymous	2024-04-26 03:43:00 (2 years ago)	Malicious Activity	Hacking Web App Attack
🇮🇩 penjaga BRIN	2024-04-25 20:15:41 (2 years ago)	XSS (Cross Site Scripting) attempt.-177	Bad Web Bot
🇪🇸 10dencehispahard SL	2024-04-25 20:01:57 (2 years ago)	Suspicious activity detected by Modsecurity [Suspicious IP found on 4 endpoints 30 hits. Reincident ... show more Suspicious activity detected by Modsecurity [Suspicious IP found on 4 endpoints 30 hits. Reincident by 0. Rules:] show less	Web App Attack
🇮🇩 penjaga BRIN	2024-04-24 20:14:11 (2 years ago)	Multiple WP scan detected from same source ip.-240	Web App Attack
🇨🇿 lp	2024-04-24 17:42:53 (2 years ago)	Bot webscan: 1 attempts were recorded from 104.248.203.61 104.248.203.61 "GET /webadmin/policy/group ... show more Bot webscan: 1 attempts were recorded from 104.248.203.61 104.248.203.61 "GET /webadmin/policy/group_table_ajax.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 404 4064 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" show less	Port Scan
Anonymous	2024-04-23 11:47:19 (2 years ago)	General scanning observed in manual log review.	Web App Attack
Anonymous	2024-04-22 20:09:01 (2 years ago)	Bot / scanning and/or hacking attempts: POST /timesheet/login.php HTTP/1.1, GET /log?type=%22%3C/scr ... show more Bot / scanning and/or hacking attempts: POST /timesheet/login.php HTTP/1.1, GET /log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain, POST /NateMail.php HTTP/1.1, GET /free_time_failed.cgi?err_msg=<script>alert(document.domain, GET /wp-content/plugins/sagepay-server-gateway-for-woocommerce/, GET /admin/tools/a--%3C%2Fscript%3E%3Cscript%3Ealert%28document, GET /index.php?m=search&c=index&a=initxqb4n<img%20src%3da%20one, idle, streams: 0/46/46/0/0 (open/recv/resp/push/rst), done, streams: 0/1/1/0/0 (open/recv/resp/push/rst), idle, streams: 0/2/2/0/0 (open/recv/resp/push/rst) show less	Hacking Web App Attack
🇧🇪 cmbplf	2024-04-22 17:59:12 (2 years ago)	5.177 4xx requests in 1 hour (1w6d23h)	Brute-Force Bad Web Bot
🇳🇱 Savvii	2024-04-22 17:42:29 (2 years ago)	36 attempts against mh-misbehave-ban on redirect	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2024-04-22 16:32:44 (2 years ago)	30 attempts against mh-misbehave-ban on redirect	Brute-Force Bad Web Bot Web App Attack
🇦🇺 clapper	2024-04-21 20:25:26 (2 years ago)	(mod_security) mod_security (id:949110) triggered by 104.248.203.61 (NL/The Netherlands/-): 3 in the ... show more (mod_security) mod_security (id:949110) triggered by 104.248.203.61 (NL/The Netherlands/-): 3 in the last 3600 secs; ID: LUC show less	Email Spam Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2024-04-21 19:10:17 (2 years ago)	(mod_security) mod_security (id:211190) triggered by 104.248.203.61 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:211190) triggered by 104.248.203.61 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 21 15:10:04.326689 2024] [security2:error] [pid 17018] [client 104.248.203.61:14532] [client 104.248.203.61] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|salsberggroup.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /process/feries.php?fichier=../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "salsberggroup.com"] [uri "/process/feries.php"] [unique_id "ZiVkjKXljMmHmyTbiswa4gAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2024-04-21 18:12:38 (2 years ago)	10 attempts against mh-misc-ban on taro	Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇹 185.124.182.141

🇮🇳 182.70.243.207

🇧🇷 177.74.138.162

🇺🇸 172.236.228.208

🇺🇸 67.223.117.122

🇳🇱 45.148.10.152

🇺🇸 45.79.181.223

🇯🇵 2406:da16:b16:bb01:3e66:d96e:73f9:fe55

🇹🇭 203.154.158.195

🇿🇦 197.95.122.253

🇮🇹 194.60.212.150

🇳🇱 176.65.149.138

🇨🇳 150.255.94.192

🇨🇳 119.134.101.116

🇨🇳 116.207.109.217

🇳🇱 89.190.156.9

🇸🇬 47.128.54.28

🇺🇸 216.25.89.108

🇳🇱 176.65.139.130

🇰🇷 116.34.14.135