This IP address has been reported a total of
11
times from
8 distinct
sources.
104.22.20.93 was first reported on
December 18th 2025 , and the most recent report was
1 day ago Belgium
with 3
reports;
United States of America
with 1
report.
The most common categories in these recent reports were:
Web App Attack
4
times;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
jcbriar
2026-10-18 13:47:45
(1 day ago)
Searching for vulnerable scripts
Hacking
Web App Attack
🇧🇪
madeit
2026-10-16 04:54:50
(4 days ago)
Web App Attack
🇧🇪
madeit
2026-09-04 06:24:42
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-26 03:41:45
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-10 16:46:16
(2 months ago)
Web App Attack
🇺🇸
mawan
2026-08-08 12:31:26
(2 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 20:29:43
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.20.93 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.20.93 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 16:29:19.101497 2026] [security2:error] [pid 5358:tid 5358] [client 104.22.20.93:14332] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "register-yacht-cook-islands.com"] [uri "/.env.backup"] [unique_id "ajw-H46rJVzShnmCiEmczQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
OptimusGO
2026-02-19 08:59:31
(8 months ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-02-19 08:59:21 UTC
Log evidence:
02/19/2026-08:59:09.306192 [**] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [**] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 104.22.20.93:10873 -> 185.127.18.66:2087
02/19/2026-08:59:10.335765 [**] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [**] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 104.22.20.93:10873 -> 185.127.18.66:2087
show less
Port Scan
Brute-Force
🇩🇪
2048
2026-02-02 19:25:35
(8 months ago)
2026-02-02T20:24:38.791223+01:00 machodeer kernel: [2092511.034843] [UFW BLOCK] IN=ens3 OUT= MAC=RED ...
show more
2026-02-02T20:24:38.791223+01:00 machodeer kernel: [2092511.034843] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=104.22.20.93 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=28340 DF PROTO=TCP SPT=56583 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
2026-02-02T20:24:39.678272+01:00 machodeer kernel: [2092511.921404] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=104.22.20.93 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=26434 DF PROTO=TCP SPT=43609 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
2026-02-02T20:24:40.600495+01:00 machodeer kernel: [2092512.843097] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=104.22.20.93 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=37894 DF PROTO=TCP SPT=49753 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
show less
Port Scan
🇫🇷
MeduzaCTI
2026-01-31 12:55:29
(8 months ago)
Indicator Report
Indicator: 104.22.20.93
Reporter: SolidSnake
Description: Active Threat Malicious ...
show more
Indicator Report
Indicator: 104.22.20.93
Reporter: SolidSnake
Description: Active Threat Malicious IP
Tags: Honeypot,Scanner,Malicious
Source: Meduza CTI Platform
Reference: https://meduzacti.com
show less
Hacking
🇺🇸
MirrorImageGaming
2025-12-18 03:09:11
(10 months ago)
HTTP probe(s) @ TCP 80 US
Port Scan
Showing 1 to
11
of 11 reports
