JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.104.161.69

172.104.161.69 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 56%: ?

56%

ISP	Linode
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63949
Hostname(s)	172-104-161-69.ip.linodeusercontent.com
Domain Name	linode.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 172.104.161.69

Whois 172.104.161.69

IP Abuse Reports for 172.104.161.69:

This IP address has been reported a total of 23 times from 9 distinct sources. 172.104.161.69 was first reported on July 5th 2026, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-06 12:57:46 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 08:57:39.237232 2026] [security2:error] [pid 11014:tid 11014] [client 172.104.161.69:62663] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fireflypov.com"] [uri "/sftp-config.json"] [unique_id "akumQ-QEbASurjOBZjsEWQAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 08:50:51 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 04:50:44.068359 2026] [security2:error] [pid 4979:tid 4979] [client 172.104.161.69:65353] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "epicureankids.com"] [uri "/sftp-config.json"] [unique_id "aktsZAhTtafvGmtNgxL4sgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-06 06:08:15 (5 days ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 04:42:48 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 00:42:39.747848 2026] [security2:error] [pid 12511:tid 12511] [client 172.104.161.69:53648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ww-bbs.com"] [uri "/fclboosters/sftp-config.json"] [unique_id "aksyP-1Kq6cZbleTgKfeyQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-07-06 04:12:01 (5 days ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 03:31:43 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 23:31:39.807561 2026] [security2:error] [pid 17472:tid 17472] [client 172.104.161.69:55922] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eweddingsupplies.com"] [uri "/sftp-config.json"] [unique_id "akshm_uMtz9eZrUHLnjg0QAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 02:58:43 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 22:58:39.516990 2026] [security2:error] [pid 1146:tid 1146] [client 172.104.161.69:56848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "farjam.com"] [uri "/sftp-config.json"] [unique_id "aksZ34ILDRWfEHxiXTurkgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 02:26:02 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 22:25:54.892488 2026] [security2:error] [pid 10991:tid 10991] [client 172.104.161.69:53228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "favourpa.com"] [uri "/sftp-config.json"] [unique_id "aksSMoJGLmT6MLFPn1AlCgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-05 23:33:08 (5 days ago)	(caddyscan) Scanner path probe from 172.104.161.69 (SG/Singapore/172-104-161-69.ip.linodeusercontent ... show more (caddyscan) Scanner path probe from 172.104.161.69 (SG/Singapore/172-104-161-69.ip.linodeusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.104.161.69 - - [05/Jul/2026:23:32:52 +0000] "GET /.vscode/sftp.json HTTP/1.1" [REDACTED] 200 2627 172.104.161.69 - - [05/Jul/2026:23:32:53 +0000] "GET /.vscode/ftp-config.json HTTP/1.1" [REDACTED] 200 2627 172.104.161.69 - - [05/Jul/2026:23:32:54 +0000] "GET /.vscode/ftp-sync.json HTTP/1.1" [REDACTED] 200 2627 172.104.161.69 - - [05/Jul/2026:23:33:02 +0000] "GET /.vscode/sftp.json HTTP/1.1" [REDACTED] 200 2627 172.104.161.69 - - [05/Jul/2026:23:33:03 +0000] "GET /.vscode/ftp-config.json HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-05 23:02:53 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 19:02:49.069173 2026] [security2:error] [pid 15926:tid 15926] [client 172.104.161.69:54277] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prostar.industries"] [uri "/sftp-config.json"] [unique_id "akrimcXJblKxWbKkeVs0OgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-07-05 19:29:37 (6 days ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 nyt	2026-07-05 19:00:34 (6 days ago)	Deploy Config Probe	Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 18:18:01 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 14:17:54.252376 2026] [security2:error] [pid 27843:tid 27843] [client 172.104.161.69:60626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enjoymycondos.com"] [uri "/sftp-config.json"] [unique_id "akqf0qZAu0dajkouBtBc4wAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 17:54:39 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 13:54:36.146244 2026] [security2:error] [pid 7164:tid 7164] [client 172.104.161.69:52220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eworld-media.com"] [uri "/sftp-config.json"] [unique_id "akqaXPuAcccz-qrKGauvyQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 17:17:41 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercon ... show more (mod_security) mod_security (id:210492) triggered by 172.104.161.69 (172-104-161-69.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 13:17:36.919400 2026] [security2:error] [pid 6401:tid 6401] [client 172.104.161.69:60079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "elmarwamarine.com"] [uri "/sftp-config.json"] [unique_id "akqRsCCmx-NJruKEDkPk9AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 124.253.199.95

🇲🇾 49.124.153.17

🇺🇸 20.80.80.29

🇺🇸 205.210.31.88

🇵🇱 176.53.159.197

🇫🇷 91.231.89.71

🇺🇸 74.7.228.55

🇳🇱 45.153.34.165

🇬🇧 195.60.166.254

🇧🇷 187.19.252.56

🇵🇰 103.186.77.85

🇧🇩 103.78.227.143

🇺🇸 81.30.98.91

🇳🇱 45.148.10.36

🇳🇱 45.148.10.29

🇺🇸 20.42.89.33

🇨🇳 223.88.26.120

🇬🇧 168.100.161.249

🇧🇷 131.221.54.132

🇺🇸 104.196.210.12