JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.23.170.89

Neutral Activity Whitelisted Subnet

Abuse confidence score ?

0% Low Risk

145 reports

53 reporters · latest 3 hours ago

104.23.170.89 is an IP address from within our whitelist belonging to the subnet 104.16.0.0/13, which we identify as "Cloudflare Reverse Proxy".

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 104.23.170.89

Export CSV

This IP address has been reported a total of 145 times from 53 distinct sources. 104.23.170.89 was first reported on March 1st 2025, and the most recent report was 3 hours ago. In the last 60 days, the top reporter locations were: United States of America with 41 reports; Germany with 9 reports; Ukraine with 6 reports. The most common categories in these recent reports were: Web App Attack 66 times; Bad Web Bot 49 times; Brute-Force 42 times; Hacking 10 times; Port Scan 5 times; Other 13 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-08 18:28:55 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 14:28:49.594761 2026] [security2:error] [pid 16874:tid 16874] [client 104.23.170.89:14130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "interforce.com"] [uri "/.svn/entries"] [unique_id "asfg4bLzBP3ZdOdU1ymswwAAAGc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 thesimonmanuel	2026-10-08 17:29:32 (4 hours ago)	104.23.170.89 - - [08/Oct/2026:22:59:31 +0530] "GET /.env.staging HTTP/1.1" 301 162 "-" "Mozilla/5.0 ... show more 104.23.170.89 - - [08/Oct/2026:22:59:31 +0530] "GET /.env.staging HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 14:04:20 (7 hours ago)	(mod_security) mod_security (id:949110) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 10:04:09.285113 2026] [security2:error] [pid 21964:tid 21964] [client 104.23.170.89:9218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunstrongmetal.com"] [uri "/.env.local"] [unique_id "asei2b09Jad9XiVcToJIPQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2026-10-08 11:51:28 (9 hours ago)	port=80, indicator_type=info-leak	Hacking
🇺🇸 conrad10781	2026-10-08 10:42:34 (10 hours ago)	nginx-dot-env	Web App Attack
🇪🇸 bohl-aiG5aef	2026-10-08 07:38:09 (14 hours ago)	Suricata Alert [SID:2009955] ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerab ... show more Suricata Alert [SID:2009955] ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 07:09:02 (14 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 03:08:55.959796 2026] [security2:error] [pid 19608:tid 19608] [client 104.23.170.89:13625] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bakerimaging.com"] [uri "/.env.production"] [unique_id "asdBh9On3vF9u-FMDjVClgAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-08 07:02:17 (14 hours ago)	[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.23.170.89 - - [08/Oct/2026:09:02:08 +0200] "GET /.env.old HTTP/1.1" 301 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0" ... show less	Bad Web Bot Web App Attack
🇮🇩 David Koswari	2026-10-08 06:39:00 (14 hours ago)	REQ_BLOCKED_ACL	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted
Anonymous	2026-10-08 05:48:42 (15 hours ago)	Sensitive Configuration File Disclosure.	Hacking
🇺🇸 TPI-Abuse	2026-10-08 03:40:30 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 23:40:25.328300 2026] [security2:error] [pid 7689:tid 7689] [client 104.23.170.89:12462] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jdubindustries.com"] [uri "/.git/HEAD"] [unique_id "ascQqSB0j3uS-m5TgorKfgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 BlueWire Hosting	2026-10-08 01:57:50 (19 hours ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 01:37:23 (20 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 21:37:03.925463 2026] [security2:error] [pid 8510:tid 8510] [client 104.23.170.89:9273] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.takemehomedogrescue.org"] [uri "/.env"] [unique_id "asbzv2_tKyyqR70DRSTk9QAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-08 00:41:06 (20 hours ago)	104.23.170.89 - - [08/Oct/2026:02:41:04 +0200] "GET /. HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows N ... show more 104.23.170.89 - - [08/Oct/2026:02:41:04 +0200] "GET /. HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-07 23:24:31 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.23.170.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 19:24:27.518618 2026] [security2:error] [pid 8558:tid 8558] [client 104.23.170.89:13168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cruisingforsex.com"] [uri "/.env.save"] [unique_id "asbUq1kYlNT9sa5hymJTIAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 145 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 199.19.225.232

🇺🇸 195.184.76.55

🇺🇸 148.59.129.62

🇺🇸 136.113.19.205

🇰🇷 119.192.128.163

🇵🇱 94.154.17.51

🇳🇱 77.91.71.91

🇧🇬 62.60.134.210

🇫🇷 51.254.103.32

🇭🇰 43.161.224.78

🇺🇸 162.251.120.26

🇺🇸 162.216.149.250

🇫🇮 147.185.133.233

🇹🇼 114.46.150.176

🇨🇳 110.81.20.203

🇨🇦 85.217.149.74

🇬🇧 35.203.210.114

🇩🇪 34.185.247.54

🇹🇼 34.80.90.61

🇳🇴 20.251.194.156