JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.153.111

Activity Trending Down

Abuse Confidence Score

37% Elevated

9 reports

8 reporters · latest 1 week ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇺🇸 United States of America
City: East Los Angeles, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

9 from 8 distinct reporters

First reported

October 2nd 2026

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 5 🇦🇷 Argentina 1 🇧🇷 Brazil 1

Most common categories Port Scan 3 Web App Attack 2 Brute-Force 2 Bad Web Bot 2 Exploited Host 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-11-04 14:35:14 UTC · (1 week ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-11-04 UTC.	Brute-Force Exploited Host
🇺🇸 mutebot.net	2026-11-01 08:17:55 UTC · (1 week ago)	SRC=104.28.153.111, PROTO=TCP, SPT=19787, DPT=2539 SRC=104.28.153.111, PROTO=TCP, SPT=19787, DPT=2539 SRC=104.28.153.111, PROTO=TCP, SPT=19787, DPT=2539 SRC=104.28.153.111, PROTO=TCP, SPT=19787, DPT=2539	Port Scan
🇺🇸 mutebot.net	2026-10-31 08:17:25 UTC · (2 weeks ago)	SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT= ... show more SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 SRC=104.28.153.111, PROTO=TCP, SPT=58807, DPT=3442 show less	Port Scan
🇺🇸 JL41414141	2026-10-28 06:21:27 UTC · (2 weeks ago)	104.28.153.111 - - [28/Oct/2026:06:21:27 +0000] "GET /geoip HTTP/1.1" 404 146 "-" "-" 104.28.153.111 - - [28/Oct/2026:06:21:27 +0000] "GET /v2/free/self HTTP/1.1" 404 146 "-" "-" ...	Web Spam
Anonymous	2026-10-27 12:13:21 UTC · (2 weeks ago)	apache vulnerability scan	Web App Attack
🇨🇭 backslash	2026-10-26 18:18:01 UTC · (2 weeks ago)	block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638	Bad Web Bot
🇺🇸 TPI-Abuse	2026-10-23 14:28:01 UTC · (3 weeks ago)	(mod_security) mod_security (id:217210) triggered by 104.28.153.111 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 10:27:53.413467 2026] [security2:error] [pid 7602:tid 7602] [client 104.28.153.111:19219] M ... show more (mod_security) mod_security (id:217210) triggered by 104.28.153.111 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 10:27:53.413467 2026] [security2:error] [pid 7602:tid 7602] [client 104.28.153.111:19219] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|probe.yyy.gv.uy:443\|F\|4"] [data "CONNECT probe.yyy.gv.uy:443 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "probe.yyy.gv.uy"] [uri "/"] [unique_id "attu6RKkfnKP-poYG31xswAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ISPLtd	2026-10-18 08:55:13 UTC · (3 weeks ago)	Oct 18 05:54:48 104.28.153.111 TCP SPT=57842 DPT=1111 SYN Oct 18 05:54:49 104.28.153.111 TCP SPT=57842 DPT=1111 SYN Oct 18 05:54:50 104.28.153.111 TCP SPT=57842 DPT=1111 ...	Port Scan
🇩🇪 edgeshield	2026-10-02 02:53:51 UTC · (1 month ago)	Automated web request flooding / DDoS (EdgeShield WAF).	DDoS Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇩 172.68.163.164

🇺🇸 2a06:98c0:3600::103

🇩🇪 194.88.98.112

🇺🇦 176.124.133.22

🇳🇱 109.160.32.159

🇵🇱 51.68.137.114

🇲🇦 41.140.37.43

🇨🇳 39.105.155.114

🇷🇴 2.57.121.25

🇳🇱 200.138.46.226

🇮🇹 185.197.9.45

🇴🇲 161.8.77.108

🇺🇸 142.111.152.167

🇺🇸 142.93.193.150

🇺🇸 103.203.57.22

🇳🇬 98.97.76.174

🇺🇸 68.227.77.110

🇺🇸 3.235.24.223

🇺🇸 2a03:2880:f802::

🇳🇱 195.178.110.30