JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.23.187.148

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

46 reports

18 reporters · latest 10 minutes ago

104.23.187.148 is on our whitelist as Cloudflare Reverse Proxy via the subnet 104.16.0.0/13.

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇺🇸 United States of America
City: Newark, New Jersey

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

46 from 18 distinct reporters

First reported

March 5th 2025

Most recent report

10 minutes ago

Last 60 days

Top reporter locations 🇧🇪 Belgium 5 🇵🇱 Poland 1

Most common categories Web App Attack 6 Hacking 1 Bad Web Bot 1

Recent reports We have received reports of abusive activity from this IP address within the last week. This IP is on our whitelist as Cloudflare Reverse Proxy. Shared services like this are often reported for traffic that is not abuse, so review the reports before blocking.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 madeit	2026-11-14 18:12:48 UTC · (10 minutes ago)		Web App Attack
🇵🇱 Budyn	2026-11-06 11:11:28 UTC · (1 week ago)	[Budyn SOC Canary] \| Event: AWS Key Compromised! \| Evidence: \| Memo: AWS_Token_10 \| Action: AWS API Call \| Token ID: 53hmvky4jw5pgwl8xxid8p06l \| Client tool: Apache-HttpClient/UNAVAILABLE (Java/25.0.5)	Hacking Bad Web Bot Web App Attack
🇧🇪 madeit	2026-11-05 17:47:11 UTC · (1 week ago)		Web App Attack
🇧🇪 madeit	2026-10-23 05:16:39 UTC · (3 weeks ago)		Web App Attack
🇧🇪 madeit	2026-10-13 13:52:57 UTC · (1 month ago)		Web App Attack
🇧🇪 madeit	2026-09-24 16:40:02 UTC · (1 month ago)		Web App Attack
🇧🇪 madeit	2026-09-13 12:59:17 UTC · (2 months ago)		Web App Attack
🇦🇱 router.al	2026-09-01 14:40:29 UTC · (2 months ago)	09/01/2026-14:40:28.778176 104.23.187.148 Protocol: 6 ET SCAN LeakIX Inbound User-Agent	Hacking
🇧🇪 madeit	2026-08-29 21:06:32 UTC · (2 months ago)		Web App Attack
🇧🇪 madeit	2026-08-07 10:48:55 UTC · (3 months ago)		Web App Attack
🇩🇪 ValtonTahiri	2026-07-27 19:34:30 UTC · (3 months ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=104.23.187.148; proto=TCP; source_port=9475; targe ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=104.23.187.148; proto=TCP; source_port=9475; target_port=8443; flags=SYN show less	Port Scan
🇺🇸 TPI-Abuse	2026-04-01 04:44:12 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 00:44:05.411169 2026] [security2:error] [pid 28668:tid 28668] [client 104.23.187.148:12951] ... show more (mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 00:44:05.411169 2026] [security2:error] [pid 28668:tid 28668] [client 104.23.187.148:12951] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.psychoatomicpower.com"] [uri "/api/.env"] [unique_id "acyilbB3mVesSt9t2jbqbAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-30 04:35:52 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 00:35:46.798517 2026] [security2:error] [pid 28808:tid 28808] [client 104.23.187.148:12961] ... show more (mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 00:35:46.798517 2026] [security2:error] [pid 28808:tid 28808] [client 104.23.187.148:12961] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.luxebikinis.com"] [uri "/docker/.env"] [unique_id "acn9okl1U8sHmypYKI0F7AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-20 09:25:15 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:25:09.634711 2026] [security2:error] [pid 20965:tid 20965] [client 104.23.187.148:9640] ... show more (mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:25:09.634711 2026] [security2:error] [pid 20965:tid 20965] [client 104.23.187.148:9640] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.edelbaumarchitect.com"] [uri "/api/.env"] [unique_id "ab0SdTxdMnRqT1zmRIr7zQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-20 08:35:55 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:35:49.336288 2026] [security2:error] [pid 8616:tid 8616] [client 104.23.187.148:13881] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.187.148 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:35:49.336288 2026] [security2:error] [pid 8616:tid 8616] [client 104.23.187.148:13881] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.vicmackenzie.com"] [uri "/.env.bak"] [unique_id "ab0G5eHMlcujlbC1ohgU6AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 46 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 162.216.149.82

🇪🇨 2800:440:122e:5600:6d77:1aaa:b158:6c24

🇬🇧 165.154.174.206

🇺🇸 162.216.149.77

🇺🇸 161.35.183.194

🇨🇳 119.96.173.169

🇷🇺 80.234.7.34

🇸🇬 43.172.198.101

🇺🇸 3.129.187.38

🇮🇩 202.51.214.98

🇷🇴 193.46.255.86

🇺🇸 162.216.150.46

🇺🇸 162.216.149.73

🇺🇸 162.216.149.7

🇨🇳 111.21.46.78

🇩🇪 109.160.32.49

🇺🇸 50.116.30.65

🇲🇿 197.219.228.242

🇺🇸 162.216.149.68

🇺🇸 162.216.149.61