AbuseIPDB » 104.46.213.180

104.46.213.180 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 49%: ?

49%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 104.46.213.180

Whois 104.46.213.180

IP Abuse Reports for 104.46.213.180:

This IP address has been reported a total of 38 times from 24 distinct sources. 104.46.213.180 was first reported on March 21st 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
LRob.fr	2025-03-26 00:11:38 (1 month ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
LRob.fr	2025-03-25 00:02:13 (1 month ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
LRob.fr	2025-03-23 00:08:52 (1 month ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
IRISIO	2025-03-22 22:09:36 (1 month ago)	scans/SQL injection/spam posts : 679 queries	SQL Injection Web App Attack
MAGIC	2025-03-22 15:01:18 (1 month ago)	VM5 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Evag Touf	2025-03-22 14:59:02 (1 month ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 104.46.213.180 (JP/Japan ... show more(apache-scanners) Failed apache-scanners trigger with match [redacted] from 104.46.213.180 (JP/Japan/-): (CF_ENABLE) show less	Port Scan
strefapi_com	2025-03-22 13:21:41 (1 month ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
antlac1	2025-03-22 13:06:28 (1 month ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
Ivo Vynckier	2025-03-22 12:15:00 (1 month ago)	104.46.213.180 - - [22/Mar/2025:04:32:51 +0100] "GET /aksinet.php HTTP/1.1" 301 257 "-" "-" 1 ... show more104.46.213.180 - - [22/Mar/2025:04:32:51 +0100] "GET /aksinet.php HTTP/1.1" 301 257 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:53 +0100] "GET /wp-admin/js/about.php HTTP/1.1" 404 5550 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:53 +0100] "GET /wp-includes/wp-activate.php HTTP/1.1" 404 5550 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:54 +0100] "GET /eq2hbpgs.php HTTP/1.1" 404 27 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:54 +0100] "GET /indeex.php HTTP/1.1" 404 27 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:55 +0100] "GET /edit-link-form.php HTTP/1.1" 404 27 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:55 +0100] "GET /form.php HTTP/1.1" 404 27 "-" "-" 104.46.213.180 - - [22/Mar/2025:04:32:56 +0100] "GET /css.php HTTP/1.1" 301 253 "-" "-" show less	Brute-Force Web App Attack
TPI-Abuse	2025-03-22 12:14:16 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.46.213.180 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 104.46.213.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 22 08:14:12.857799 2025] [security2:error] [pid 8915:tid 8915] [client 104.46.213.180:2501] [client 104.46.213.180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "garrelsms.com"] [uri "/wp-config.php"] [unique_id "Z96plHdyt0kCcXLyCL9S8QAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Burayot	2025-03-22 10:02:25 (1 month ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.46.213.180 (JP/Japan/-): 1 in t ... show moreLF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.46.213.180 (JP/Japan/-): 1 in the last 3600 secs show less	Web App Attack
TPI-Abuse	2025-03-22 08:56:26 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.46.213.180 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 104.46.213.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 22 04:56:23.101427 2025] [security2:error] [pid 24149:tid 24149] [client 104.46.213.180:3205] [client 104.46.213.180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "azcrittergetter.com"] [uri "/wp-config.php"] [unique_id "Z957N59sa05Gkf1eE7wNPAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
theEngineer	2025-03-22 08:50:31 (1 month ago)	[08:50:30] 4*: Exploit attempt against non-existent file - /aksinet.php	Hacking Bad Web Bot Web App Attack
Ba-Yu	2025-03-22 08:35:37 (1 month ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
TPI-Abuse	2025-03-22 05:59:33 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.46.213.180 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 104.46.213.180 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 22 01:59:26.241128 2025] [security2:error] [pid 713065:tid 713065] [client 104.46.213.180:7042] [client 104.46.213.180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.joaeditores.com"] [uri "/wp-config.php"] [unique_id "Z95RvrvuyEXaFrGGl7vEsgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩