JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.208.99.163

104.208.99.163 was found in our database!

This IP was reported 463 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.208.99.163

Whois 104.208.99.163

IP Abuse Reports for 104.208.99.163:

This IP address has been reported a total of 463 times from 377 distinct sources. 104.208.99.163 was first reported on August 22nd 2026, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇪 Lemmy	2026-08-23 07:20:14 (1 minute ago)		Web App Attack
🇫🇷 Entalpi.net	2026-08-23 07:05:06 (16 minutes ago)	Repeated requests against sensitive web endpoints	Web App Attack
🇺🇸 deskpass.com	2026-08-23 06:59:20 (22 minutes ago)	GET /term.php	Web App Attack
🇸🇪 sweplox.se	2026-08-23 06:52:51 (28 minutes ago)	Ip 104.208.99.163 performed 'crowdsecurity/http-crawl-non_statics' (68 events over 13.974002766s) at ... show more Ip 104.208.99.163 performed 'crowdsecurity/http-crawl-non_statics' (68 events over 13.974002766s) at 2026-08-23 06:52:49.735643008 +0000 UTC show less	Bad Web Bot Web App Attack
🇹🇷 oalver	2026-08-23 06:48:32 (33 minutes ago)	Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, ... show more Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_rate_flood, nginx_path_signature. Sources: nginx. Details: 404_flood: 10 requests to /saka.php (HTTP 404) within 60s; path_signature: request to /wp-admin/css/colors/modern/ (HTTP 301); auth_flood: 8 requests to /wp-includes/js/jquery/ (HTTP 403) within 60s. First seen: 2026-08-22. Risk score: 100/100. show less	Web App Attack
🇫🇷 sthoyer.de	2026-08-23 06:47:50 (33 minutes ago)	104.208.99.163 - - [23/Aug/2026:08:47:43 +0200] "GET /users/sign_in HTTP/1.1" 200 13409 "-" "-" 104. ... show more 104.208.99.163 - - [23/Aug/2026:08:47:43 +0200] "GET /users/sign_in HTTP/1.1" 200 13409 "-" "-" 104.208.99.163 - - [23/Aug/2026:08:47:44 +0200] "GET /users/sign_in HTTP/1.1" 200 13409 "-" "-" 104.208.99.163 - - [23/Aug/2026:08:47:45 +0200] "GET /users/sign_in HTTP/1.1" 200 13409 "-" "-" 104.208.99.163 - - [23/Aug/2026:08:47:46 +0200] "GET /users/sign_in HTTP/1.1" 200 13409 "-" "-" 104.208.99.163 - - [23/Aug/2026:08:47:47 +0200] "GET /users/sign_in HTTP/1.1" 200 13408 "-" "-" ... show less	Brute-Force
🇩🇰 RhQM	2026-08-23 06:43:35 (38 minutes ago)		Bad Web Bot Exploited Host Web App Attack
🇳🇿 realstuffie	2026-08-23 06:40:52 (40 minutes ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
Anonymous	2026-08-23 06:39:45 (41 minutes ago)	[Sun Aug 23 08:39:43.018034 2026] [authz_core:error] [pid 28589] [client 104.208.99.163:23366] AH016 ... show more [Sun Aug 23 08:39:43.018034 2026] [authz_core:error] [pid 28589] [client 104.208.99.163:23366] AH01630: client denied by server configuration: /var/www/html/default/zoo1.php [Sun Aug 23 08:39:43.406205 2026] [authz_core:error] [pid 28589] [client 104.208.99.163:23366] AH01630: client denied by server configuration: /var/www/html/default/btyuio.php [Sun Aug 23 08:39:43.794170 2026] [authz_core:error] [pid 28589] [client 104.208.99.163:23366] AH01630: client denied by server configuration: /var/www/html/default/00zip.php [Sun Aug 23 08:39:44.184252 2026] [authz_core:error] [pid 28589] [client 104.208.99.163:23366] AH01630: client denied by server configuration: /var/www/html/default/silver.php [Sun Aug 23 08:39:44.571530 2026] [authz_core:error] [pid 28589] [client 104.208.99.163:23366] AH01630: client denied by server configuration: /var/www/html/default/wp-mails.php ... show less	Web App Attack
🇫🇷 GoodOldTOS	2026-08-23 06:34:09 (47 minutes ago)	Bad keywords detected in request: /wp-content/	Web App Attack
🇳🇱 OrangeFlamingo	2026-08-23 06:33:01 (48 minutes ago)	2026-08-23 06:33:01 WARN Probe detected: uri=/api/songs/234717/index.php ip=104.208.99.163 ...	Web App Attack
🇺🇸 NXTwoThou	2026-08-23 06:27:01 (54 minutes ago)	/wp-content/plugins/hellopress/wp_filemanager.php	Web App Attack
🇭🇺 DumaNet	2026-08-23 06:27:00 (54 minutes ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Aug 22. 21:15:23 Source IP: 104.20 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Aug 22. 21:15:23 Source IP: 104.208.99.163 Portion of the log(s): 104.208.99.163 - [22/Aug/2026:21:15:23 +0200] "GET /sf.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:23 +0200] "GET /BDKR28WP.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:23 +0200] "GET /coffexium.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:23 +0200] "GET /ops.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:22 +0200] "GET /images.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:22 +0200] "GET /av.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:22 +0200] "GET /bulet.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:22 +0200] "GET /pk.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:22 +0200] "GET /wsd.php HTTP/1.1" 404 153 "-" "-" 104.208.99.163 - [22/Aug/2026:21:15:21 +0200] "GET /4PJcpMFsD8B.php HTTP/1.1" 404 show less	Web App Attack
🇳🇴 tmiland	2026-08-23 06:20:06 (1 hour ago)	(wordpress_404) WordPress Plugins Honeypot Trap 104.208.99.163 (HK/Hong Kong/-): 2 in the last 3600 ... show more (wordpress_404) WordPress Plugins Honeypot Trap 104.208.99.163 (HK/Hong Kong/-): 2 in the last 3600 secs; IP: 104.208.99.163; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.208.99.163 - - [23/Aug/2026:08:14:28 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 2992 "-" "-" 104.208.99.163 - - [23/Aug/2026:08:20:01 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 2992 "-" "-" show less	Brute-Force
🇺🇸 nasset	2026-08-23 06:19:27 (1 hour ago)	104.208.99.163 - - [22/Aug/2026:23:19:24 -0700] "GET /1.php?p= HTTP/1.1" 403 584 "-" "-" 104.208.99. ... show more 104.208.99.163 - - [22/Aug/2026:23:19:24 -0700] "GET /1.php?p= HTTP/1.1" 403 584 "-" "-" 104.208.99.163 - - [22/Aug/2026:23:19:25 -0700] "GET /samll.php HTTP/1.1" 403 584 "-" "-" 104.208.99.163 - - [22/Aug/2026:23:19:25 -0700] "GET /she11.php HTTP/1.1" 403 584 "-" "-" 104.208.99.163 - - [22/Aug/2026:23:19:26 -0700] "GET /kerang.php HTTP/1.1" 403 584 "-" "-" 104.208.99.163 - - [22/Aug/2026:23:19:26 -0700] "GET /m.php?p= HTTP/1.1" 403 584 "-" "-" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 463 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 92.118.39.49

🇩🇪 69.5.169.248

🇫🇷 65.111.30.122

🇺🇸 64.62.156.124

🇳🇱 31.14.32.7

🇺🇸 20.15.163.139

🇺🇸 216.25.89.101

🇱🇹 213.176.26.114

🇷🇴 193.46.255.86

🇲🇽 187.251.108.233

🇫🇮 147.185.133.162

🇨🇳 122.96.48.149

🇨🇳 118.196.139.226

🇫🇮 104.28.222.16

🇨🇦 85.217.149.65

🇶🇦 80.76.160.42

🇨🇭 216.131.108.251

🇩🇪 185.242.3.167

🇨🇳 171.8.87.19

🇺🇸 157.230.95.119