JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.23.217.19

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

70 reports

38 reporters · latest 1 week ago

104.23.217.19 is on our whitelist as Cloudflare Reverse Proxy via the subnet 104.16.0.0/13.

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇸🇪 Sweden
City: Stockholm, Stockholm

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

70 from 38 distinct reporters

First reported

May 9th 2025

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 13 🇧🇪 Belgium 4 🇩🇪 Germany 2

Most common categories Web App Attack 25 Bad Web Bot 17 Brute-Force 15 Port Scan 1 SQL Injection 1

Old reports The most recent abuse report for this IP address is from 1 week ago. This IP is on our whitelist as Cloudflare Reverse Proxy.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 S.O.B.A. Dev.	2026-10-29 21:42:02 UTC · (1 week ago)	Persistent port scanning or vulnerability scanning	Port Scan
🇧🇪 madeit	2026-10-24 16:47:43 UTC · (2 weeks ago)		Web App Attack
🇳🇱 Alt255	2026-10-19 20:19:58 UTC · (3 weeks ago)	[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.23.217.19 - - [19/Oct/2026:22:19:38 +0200] "GET /.git/config HTTP/2.0" 403 1963 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Geck ... show more [cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.23.217.19 - - [19/Oct/2026:22:19:38 +0200] "GET /.git/config HTTP/2.0" 403 1963 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-19 19:14:50 UTC · (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 15:14:41.872111 2026] [security2:error] [pid 29267:tid 29267] [client 104.23.217.19:12968] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 15:14:41.872111 2026] [security2:error] [pid 29267:tid 29267] [client 104.23.217.19:12968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "persnicketyinc.com"] [uri "/.git/HEAD"] [unique_id "atZsIYcA5eHAfVORgTNlXgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-19 05:32:24 UTC · (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 01:32:18.883104 2026] [security2:error] [pid 21719:tid 21719] [client 104.23.217.19:12270] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 01:32:18.883104 2026] [security2:error] [pid 21719:tid 21719] [client 104.23.217.19:12270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "footballxp.com"] [uri "/.git/config"] [unique_id "atWrYt92tf70MCMnVqKPFgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-18 09:16:46 UTC · (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:16:41.524913 2026] [security2:error] [pid 4142:tid 4142] [client 104.23.217.19:11135] Mod ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:16:41.524913 2026] [security2:error] [pid 4142:tid 4142] [client 104.23.217.19:11135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.airplanechristmascards.com"] [uri "/.git/HEAD"] [unique_id "atSOeTDULSADDGoMur8bIgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-10-18 03:48:04 UTC · (3 weeks ago)	[18/Oct/2026:06:48:02 +0300] -- 104.23.217.19 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /backup.zip HTTP/1.1	Bad Web Bot Web App Attack
🇳🇴 jad-abuse	2026-10-14 16:21:57 UTC · (3 weeks ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. Observed by 1 sensor(s); 3 hits.	Brute-Force Web App Attack
🇧🇪 madeit	2026-10-11 01:46:21 UTC · (4 weeks ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-10-07 09:02:23 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 05:02:20.785768 2026] [security2:error] [pid 22496:tid 22496] [client 104.23.217.19:12314] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 05:02:20.785768 2026] [security2:error] [pid 22496:tid 22496] [client 104.23.217.19:12314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.pcmail.org"] [uri "/.git/config"] [unique_id "asYKnPSmIr4j-8MQ4GALcQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-06 03:20:56 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 23:20:51.670551 2026] [security2:error] [pid 26791:tid 26791] [client 104.23.217.19:13574] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 23:20:51.670551 2026] [security2:error] [pid 26791:tid 26791] [client 104.23.217.19:13574] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.indie100.com"] [uri "/.git/config"] [unique_id "asRpE58JDdbWYNKjcwUClQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-03 22:22:32 UTC · (1 month ago)	104.23.217.19 - - [04/Oct/2026:00:22:32 +0200] "GET /.git/config HTTP/2.0" 301 169 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Version/17.0 Mobile Safari/604.1"	Web App Attack
🇺🇸 TPI-Abuse	2026-09-30 11:42:41 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 07:42:34.225584 2026] [security2:error] [pid 30059:tid 30059] [client 104.23.217.19:11774] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 07:42:34.225584 2026] [security2:error] [pid 30059:tid 30059] [client 104.23.217.19:11774] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "virttee.com"] [uri "/.git/config"] [unique_id "arz1qsWgSBHAEHCmzgpcigAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-30 11:13:30 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 07:13:23.517870 2026] [security2:error] [pid 4039:tid 4039] [client 104.23.217.19:12719] Mod ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 07:13:23.517870 2026] [security2:error] [pid 4039:tid 4039] [client 104.23.217.19:12719] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ttlatl.com"] [uri "/.git/config"] [unique_id "arzu02kSEWB7Wv6EYexO1wAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-30 04:59:21 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:59:17.657080 2026] [security2:error] [pid 18567:tid 18567] [client 104.23.217.19:11338] M ... show more (mod_security) mod_security (id:210492) triggered by 104.23.217.19 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:59:17.657080 2026] [security2:error] [pid 18567:tid 18567] [client 104.23.217.19:11338] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lockyers.com"] [uri "/.git/config"] [unique_id "aryXJetxvQNwYhszc63LVAAAABs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 70 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇷 193.151.133.105

🇰🇪 102.209.76.137

🇬🇧 83.98.196.175

🇨🇳 218.94.4.146

🇮🇳 150.129.115.95

🇨🇦 142.180.162.197

🇻🇳 123.31.193.82

🇺🇸 91.230.168.6

🇬🇧 188.28.105.8

🇵🇱 172.68.159.82

🇺🇸 147.185.132.171

🇬🇧 35.203.210.216

🇺🇦 5.58.41.81

🇿🇦 197.185.248.126

🇳🇱 193.47.62.69

🇳🇱 192.253.248.222

🇺🇸 172.212.107.121

🇳🇱 109.160.32.137

🇺🇸 40.160.73.52

🇧🇪 34.77.175.43