JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.153.57

104.28.153.57 was found in our database!

This IP was reported 120 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Miami, Florida

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.153.57

Whois 104.28.153.57

IP Abuse Reports for 104.28.153.57:

This IP address has been reported a total of 120 times from 58 distinct sources. 104.28.153.57 was first reported on November 5th 2023, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 Zdeněk Svancar	2026-07-28 22:04:58 (11 hours ago)	104.28.153.57 - - [28/Jul/2026:22:04:56 +0000] "GET /.openclaw/.env HTTP/1.1" 404 118 "-" "Mozilla/5 ... show more 104.28.153.57 - - [28/Jul/2026:22:04:56 +0000] "GET /.openclaw/.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 104.28.153.57 - - [28/Jul/2026:22:04:57 +0000] "GET /.hermes/.env HTTP/1.1" 404 118 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" ... show less	Port Scan Bad Web Bot Web App Attack
🇩🇪 sdos.es	2026-07-28 21:46:08 (12 hours ago)	"Restricted File Access Attempt - Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aw ... show more "Restricted File Access Attempt - Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials" show less	Web App Attack
🇳🇱 e.fierstra	2026-07-28 21:12:47 (12 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-07-28 17:36:44 (16 hours ago)	Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.	Web App Attack
🇺🇸 etu brutus	2026-07-28 13:15:13 (20 hours ago)	104.28.153.57 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
🇩🇪 paissangroup	2026-07-28 06:06:45 (1 day ago)	Multiple WAF Violations	Web App Attack
🇨🇭 4server	2026-07-28 04:30:43 (1 day ago)	[TueJul2806:30:35.7134622026][security2:error][pid3564489:tid3564877][client104.28.153.57:0]ModSecur ... show more [TueJul2806:30:35.7134622026][security2:error][pid3564489:tid3564877][client104.28.153.57:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"xn--sanierung-alter-huser-schweiz-hqc.ch\"][uri\"/.env\"][unique_id\"amgwa258FIxOCm-pUhcJFwAAAU8\"] show less	Hacking Web App Attack
🇨🇿 sajmon0011	2026-07-27 08:38:16 (2 days ago)	104.28.153.57 - - [27/Jul/2026:10:38:16 +0200] "GET /.gitconfig HTTP/2.0" 404 196 "-" "Mozilla/5.0 A ... show more 104.28.153.57 - - [27/Jul/2026:10:38:16 +0200] "GET /.gitconfig HTTP/2.0" 404 196 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:[email protected]" ... show less	Web App Attack
🇳🇱 e.fierstra	2026-07-27 07:52:38 (2 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-07-27 01:53:58 (2 days ago)	cloudlinux2 fail2ban: 2026-07-27 03:50:26,110 fail2ban.filter [1888]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-07-27 03:50:26,110 fail2ban.filter [1888]: INFO [plesk-wordpress] Found 216.73.161.181 - 2026-07-27 03:50:25cloudlinux2 fail2ban: 2026-07-27 03:51:13,028 fail2ban.actions [1888]: NOTICE [plesk-modsecurity] Unban 103.225.138.118cloudlinux3 run-parts(/etc/cron.weekly)[3521 starting fail2ban-vacuumcloudlinux3 fail2ban-vacuum: Vacuum of fail2ban database successfully completedcloudlinux3 run-parts(/etc/cron.weekly)[3521 finished fail2ban-vacuumcloudlinux2 fail2ban: 2026-07-27 03:52:38,855 fail2ban.filter [1888]: INFO [plesk-modsecurity] Found 104.28.153.57 - 2026-07-27 03:52:38cloudlinux2 fail2ban: 2026-07-27 03:53:02,629 fail2ban.filter [1888]: INFO [plesk-modsecurity] Found 3.27.249.93 - 2026-07-27 03:53:02cloudlinux2 fail2ban: 2026-07-27 03:52:59,900 fail2ban.filter [1888]: INFO [plesk-modsecurity] Found 3.27.249.93 - 2026-07-27 03:52:59cloudlinux2 fail2ban: 2026-07-27 03:53:03,135 fail2ban.filter [1888]: INFO [plesk-mods show less	Web App Attack
🇦🇹 Pingger Shikkoken	2026-07-26 13:01:09 (2 days ago)	2026-07-26T13:01:09+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC ... show more 2026-07-26T13:01:09+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=104.28.153.57 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=27863 DF PROTO=TCP SPT=55666 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 2026-07-26T13:01:10+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=104.28.153.57 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=27864 DF PROTO=TCP SPT=55666 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 2026-07-26T13:01:11+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=104.28.153.57 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=27865 DF PROTO=TCP SPT=55666 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Hacking Bad Web Bot
🇩🇪 raph	2026-07-26 04:05:20 (3 days ago)	[PROTECTED PATHS] crawler credentials.ini, aws.ini, aws.yml, etc.	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-25 23:28:16 (3 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.28.153.57 (US/United States/-): 1 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.28.153.57 (US/United States/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇳🇱 e.fierstra	2026-07-25 19:35:53 (3 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-25 14:21:33 (3 days ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 120 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 209.126.86.186

🇳🇱 195.178.110.30

🇷🇺 194.226.165.68

🇵🇭 122.54.210.44

🇺🇸 66.175.213.4

🇲🇾 49.124.152.30

🇺🇸 45.156.129.48

🇳🇱 45.148.10.157

🇳🇱 45.148.10.151

🇩🇪 4.184.185.91

🇺🇸 2604:a880:400:d1:0:4:c240:7001

🇺🇸 208.84.101.187

🇧🇷 205.210.31.142

🇦🇷 191.103.25.18

🇦🇷 190.220.172.154

🇺🇸 157.230.239.134

🇸🇬 103.30.195.72

🇧🇷 45.164.39.253

🇭🇰 42.201.192.43

🇧🇪 35.241.131.230