JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.23.170.125

Neutral Activity Whitelisted Subnet

Abuse confidence score ?

0% Low Risk

151 reports

52 reporters · latest 2 hours ago

104.23.170.125 is an IP address from within our whitelist belonging to the subnet 104.16.0.0/13, which we identify as "Cloudflare Reverse Proxy".

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 104.23.170.125

Export CSV

This IP address has been reported a total of 151 times from 52 distinct sources. 104.23.170.125 was first reported on February 28th 2025, and the most recent report was 2 hours ago. In the last 60 days, the top reporter locations were: United States of America with 45 reports; Germany with 9 reports; Ukraine with 6 reports. The most common categories in these recent reports were: Web App Attack 72 times; Bad Web Bot 54 times; Brute-Force 46 times; Hacking 9 times; Exploited Host 4 times; Other 7 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-13 05:48:46 (2 hours ago)	(mod_security) mod_security (id:210730) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 01:48:41.357545 2026] [security2:error] [pid 9634:tid 9634] [client 104.23.170.125:12188] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|sdwsk8.com\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sdwsk8.com"] [uri "/index.php.bak"] [unique_id "as3GOUlWVIvfJv2oaUjgAwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-13 04:52:47 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 00:52:36.738116 2026] [security2:error] [pid 22114:tid 22114] [client 104.23.170.125:14130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blackoakprop.com"] [uri "/wp-config.php"] [unique_id "as25FNWP3xfw0VytPDuD_QAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-12 13:26:19 (19 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 09:26:10.284292 2026] [security2:error] [pid 32119:tid 32119] [client 104.23.170.125:12160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "azfilmguild.org"] [uri "/.env.dev"] [unique_id "aszf8k-GVY7bRJGh3vleTQAAAFw"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2026-10-12 12:23:02 (20 hours ago)	port=80, indicator_type=info-leak	Hacking
🇺🇦 URAN Publishing Service	2026-10-12 02:33:38 (1 day ago)	[12/Oct/2026:05:33:37 +0300] -- 104.23.170.125 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /.en ... show more [12/Oct/2026:05:33:37 +0300] -- 104.23.170.125 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /.env.old HTTP/1.1 show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-12 01:12:48 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 21:12:24.041318 2026] [security2:error] [pid 10009:tid 10009] [client 104.23.170.125:13701] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pinebrookdesign.com"] [uri "/.htaccess"] [unique_id "aswz-L5kaqydByJ5dVnx8QAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 16:54:51 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 12:54:40.120736 2026] [security2:error] [pid 8662:tid 8662] [client 104.23.170.125:14206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "taltonfamily.com"] [uri "/wp-config.php.old"] [unique_id "asu_UB04MPRdAjqQcE6XEAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 12:28:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 08:27:51.472554 2026] [security2:error] [pid 16237:tid 16237] [client 104.23.170.125:13010] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haroparke.com"] [uri "/wp-config.php.bak"] [unique_id "asuAx-uLO_TVqMgsfZE25AAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 07:40:13 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 03:39:59.465384 2026] [security2:error] [pid 23726:tid 23726] [client 104.23.170.125:11251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.incrp.org"] [uri "/.env.production"] [unique_id "ass9TzwZmCi4NvxbVAfDGAAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-10 08:54:33 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 04:54:24.339856 2026] [security2:error] [pid 19108:tid 19108] [client 104.23.170.125:14159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lovechicks.com"] [uri "/.env.dev"] [unique_id "asn9QFB5sHZeLpp3T-pLRgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-10 06:15:28 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 02:15:07.108310 2026] [security2:error] [pid 25470:tid 25470] [client 104.23.170.125:12822] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "godplusus.com"] [uri "/.env.old"] [unique_id "asnX69qV_IDCfsaeWaHqUgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-09 23:33:13 (3 days ago)	GET /.env.staging HTTP/1.1 ...	Web App Attack
🇳🇱 homeshowdomain.nl	2026-10-09 21:59:10 (3 days ago)	Auto-ban: >3000 req/min op 2026-10-09	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-10-09 09:51:54 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 05:51:49.003213 2026] [security2:error] [pid 11610:tid 11610] [client 104.23.170.125:11527] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "darkcodeproductions.com"] [uri "/.svn/entries"] [unique_id "asi5NfE4srZU2d1GB7gLngAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 TaKeN	2026-10-09 04:28:32 (4 days ago)	Automated Wazuh observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application probing ... show more Automated Wazuh observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application probing from this source IP. Observed 1 matching Wazuh alert(s) between 2026-10-09T06:28:32+02:00 and 2026-10-09T06:28:32+02:00. show less	Web App Attack Hacking

Showing 1 to 15 of 151 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 94.101.190.153

🇫🇷 62.210.125.18

🇳🇱 45.148.10.141

🇺🇸 20.15.203.58

🇺🇸 2604:a00:50:218:216:3eff:fe33:6864

🇺🇸 216.25.89.83

🇮🇩 182.253.143.79

🇮🇩 163.7.6.114

🇺🇸 147.185.132.20

🇧🇷 131.100.242.102

🇮🇳 103.165.62.158

🇺🇸 91.230.168.225

🇺🇸 91.230.168.100

🇫🇷 85.217.140.22

🇫🇷 62.210.129.219

🇳🇱 45.148.10.151

🇬🇧 34.13.37.156

🇺🇸 217.181.65.53

🇩🇪 213.209.159.236

🇹🇼 198.235.24.118