JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.22.24.104

104.22.24.104 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 0%: ?

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Atlanta, Georgia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Important Note: 104.22.24.104 is an IP address from within our whitelist belonging to the subnet 104.16.0.0/13, which we identify as: "Cloudflare Reverse Proxy".

Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.

Report 104.22.24.104

Whois 104.22.24.104

IP Abuse Reports for 104.22.24.104:

This IP address has been reported a total of 23 times from 14 distinct sources. 104.22.24.104 was first reported on December 11th 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-08-17 08:12:16 (1 week ago)	104.22.24.104 - - [17/Aug/2026:10:12:13 +0200] "GET /config/api%2ephp HTTP/1.1" 403 124 "-" "curl/8. ... show more 104.22.24.104 - - [17/Aug/2026:10:12:13 +0200] "GET /config/api%2ephp HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:13 +0200] "GET /config/keys%2ephp HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:13 +0200] "GET /config/credentials%2ephp HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:13 +0200] "GET /config/packages/stripe%2eyaml HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:13 +0200] "GET /config/packages/stripe%2eyml HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:14 +0200] "GET /config/packages/payum%2eyaml HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:14 +0200] "GET /config/packages/services%2eyaml HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:14 +0200] "GET /config/services%2eyml HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [17/Aug/2026:10:12:14 +0200] "GET /config/parameters%2eyml HTTP/1.1" 403 124 ... show less	Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-08-15 19:59:35 (1 week ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-08-13 13:27:46 (1 week ago)	104.22.24.104 - - [13/Aug/2026:15:27:42 +0200] "GET /wiki HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22. ... show more 104.22.24.104 - - [13/Aug/2026:15:27:42 +0200] "GET /wiki HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:42 +0200] "GET /.env HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:42 +0200] "GET /.env.local HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.production HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.staging HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.development HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.test HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.testing HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.backup HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24.104 - - [13/Aug/2026:15:27:43 +0200] "GET /.env.old HTTP/1.1" 403 124 "-" "curl/8.7.1" 104.22.24 ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 12:01:49 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 08:01:41.496260 2026] [security2:error] [pid 3050291:tid 3050291] [client 104.22.24.104:11029] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smokeydoesit.com.pages4you.com"] [uri "/.env.production.local"] [unique_id "anxgpU9eu50Wbh6jDBz0EQAAAAg"], referer: https://www.google.com/search?q=smokeydoesit.com.pages4you.com show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 S.O.B.A. Dev.	2026-08-11 14:29:33 (1 week ago)	Persistent port scanning or vulnerability scanning	Port Scan
🇧🇪 madeit	2026-08-09 23:42:54 (2 weeks ago)		Web App Attack
🇸🇬 wulan17	2026-08-01 14:10:22 (3 weeks ago)	Fail2ban: Web bot/vulnerability scanning detected.	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-29 16:13:16 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 12:13:08.331474 2026] [security2:error] [pid 2793399:tid 2793399] [client 104.22.24.104:13266] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "glaswood.com"] [uri "/.git/config"] [unique_id "amomlGZHhxTp8cZMq83JZAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 04:10:11 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 00:10:04.442009 2026] [security2:error] [pid 1670611:tid 1670618] [client 104.22.24.104:11451] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aafm.us"] [uri "/.git/HEAD"] [unique_id "aml9HJx8GJbZCilkLA-mDQAAAUM"], referer: https://www.google.com/search?q=aafm.us show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 dyln	2026-07-12 06:42:42 (1 month ago)	Dyls honeypot brute-force: proto8 (2 total hits)	Brute-Force
🇦🇺 dyln	2026-07-08 22:31:24 (1 month ago)	Dyls honeypot brute-force: proto8 (1 total hits)	Brute-Force
🇺🇸 TPI-Abuse	2026-06-17 01:13:02 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 21:12:56.451733 2026] [security2:error] [pid 1481:tid 1499] [client 104.22.24.104:11960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.jd-web-designs.com"] [uri "/.env.dist"] [unique_id "ajH0mOl6MHEehRvge7v8WgAAAc8"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-06-16 22:01:00 (2 months ago)	Auto-ban: >3000 req/min op 2026-06-16	Web App Attack SSH Hacking
🇯🇵 Kinsei Engineering Inc.	2026-05-15 17:35:16 (3 months ago)	UFW:High-frequency access to unused ports	Port Scan
🇺🇸 TPI-Abuse	2026-05-09 20:20:39 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.22.24.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 16:20:33.820678 2026] [security2:error] [pid 20955:tid 20955] [client 104.22.24.104:11732] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "no504.com"] [uri "/.git/config"] [unique_id "af-XEey_xJFbdzsKbOll-AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 2804:14d:5c85:87cf:d6e:1b1b:d900:d774

🇷🇴 193.32.162.84

🇧🇪 172.217.41.216

🇰🇷 49.247.37.22

🇳🇱 45.153.34.87

🇺🇸 2620:18c:0:192::e0:209

🇺🇸 2607:f8b0:4001:c17::12b

🇮🇩 202.154.45.32

🇩🇪 167.94.146.56

🇧🇮 154.117.199.56

🇮🇳 125.20.230.46

🇵🇰 124.29.214.39

🇨🇳 121.236.84.56

🇻🇳 103.189.208.13

🇩🇪 69.5.169.13

🇧🇪 34.52.172.57

🇸🇪 31.208.75.143

🇨🇳 27.17.201.209

🇧🇷 2804:1b3:a781:b7d1:f52f:866f:79b4:81ee

🇹🇼 198.235.24.109