AbuseIPDB » 104.22.64.147
104.22.64.147
This IP was reported 8 times. Confidence of
Abuse
is 0% : ?
ISP
Cloudflare, Inc.
Usage Type
Data Center/Web Hosting/Transit
ASN
AS13335
Domain Name
cloudflare.com
Country
🇺🇸
United States of America
City
Chicago, Illinois
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
Important Note: 104.22.64.147 is an IP address from within
our whitelist belonging to the subnet
104.16.0.0/13 ,
which we identify as: "Cloudflare Reverse Proxy" .
Whitelisted netblocks are typically owned by trusted entities, such as Google
or Microsoft who may use them for search engine spiders. However, these same entities
sometimes also provide cloud servers and mail services which are easily abused. Pay special
attention when trusting or distrusting these IPs.
IP Abuse Reports for 104.22.64.147 :
This IP address has been reported a total of
8
times from
6 distinct
sources.
104.22.64.147 was first reported on
March 26th 2026 , and the most recent report was
1 week ago
Old Reports:
The most recent abuse report for this IP address is from
1 week ago
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇧🇪
madeit
2026-09-13 15:43:27
(1 week ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 17:57:50
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.22.64.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.64.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 13:57:44.277224 2026] [security2:error] [pid 9099:tid 9107] [client 104.22.64.147:14142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lasertagmetairie.com"] [uri "/.env.save"] [unique_id "antimHWfDaUVRnk-t4h4rwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-08-08 17:59:03
(1 month ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇬🇧
OptimusGO
2026-08-07 11:04:03
(1 month ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-08-07 12:04:03 UTC
Log evidence:
08/07/2026-12:04:02.646778 [**] [1:1000103:1] SECURITY Management Port Probe - CRITICAL [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 104.22.64.147:12626 -> 185.127.18.66:8080
show less
Port Scan
Brute-Force
🇧🇪
madeit
2026-08-06 12:22:46
(1 month ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 08:35:28
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.64.147 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.64.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 04:35:15.993585 2026] [security2:error] [pid 1575:tid 1575] [client 104.22.64.147:9968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "qu1ck.com"] [uri "/.env.dist"] [unique_id "aldGQ1ztgbfL3eeGi4RB2wAAADI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
acadeova
2026-05-01 12:02:40
(4 months ago)
🚨 Recon detected (nft drop)
SRC=104.22.64.147
Observed=TCP dpt=80 in=enp0s6 ttl=56
Time=recent(journ ...
show more
🚨 Recon detected (nft drop)
SRC=104.22.64.147
Observed=TCP dpt=80 in=enp0s6 ttl=56
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
2026-03-26 17:53:03
(5 months ago)
104.22.64.147 - - [26/Mar/2026:19:52:30 +0200] "GET /.well-known/acme-challenge/cloud.php/wp-content ...
show more
104.22.64.147 - - [26/Mar/2026:19:52:30 +0200] "GET /.well-known/acme-challenge/cloud.php/wp-content/themes/finley/rhuk_milkywayadmins.php HTTP/1.1" 404 124 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
104.22.64.147 - - [26/Mar/2026:19:52:30 +0200] "GET /.well-known/acme-challenge/cloud.php/wp-content/themes/finley/beeztmpdomaine.php HTTP/1.1" 404 124 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
104.22.64.147 - - [26/Mar/2026:19:52:37 +0200] "GET /.well-known/acme-challenge/cloud.php/wp-content/themes/finley/wp-4033.php HTTP/1.1" 404 124 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
104.22.64.147 - - [26/Mar/2026:19:52:39 +0200] "GET /.well-known/acme-challenge/cloud.php/wp-content/themes/finley/beezbeez.php HTTP/1.1" 404 124 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
104.22.64.147 - - [26/Mar/2026:19:52:47 +0200] "GET /.well-known/acme-challenge/cloud.php/wp-content/themes/finley/c100.php HTTP/1.1
...
show less
Brute-Force
Web App Attack
Showing 1 to
8
of 8 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: