JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.157.104

Recent Activity

Abuse confidence score ?

81% Critical

368 reports

227 reporters · latest 13 hours ago

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 104.28.157.104

Export CSV

This IP address has been reported a total of 368 times from 227 distinct sources. 104.28.157.104 was first reported on April 6th 2023, and the most recent report was 13 hours ago. In the last 60 days, the top reporter locations were: Netherlands with 7 reports; Germany with 4 reports; India with 4 reports. The most common categories in these recent reports were: Web App Attack 19 times; Bad Web Bot 12 times; Brute-Force 9 times; SSH 4 times; Hacking 4 times; Other 6 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Alt255	2026-10-27 07:44:40 (13 hours ago)	[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.157.104 - - [27/Oct/2026:08:44:24 +0100] "GET /.env.test HTTP/1.1" 404 7294 "https://www.google.com/search?q=www.yamahamotorprofessional.nl" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-27 05:54:55 (15 hours ago)	104.28.157.104 - - [27/Oct/2026:13:54:55 +0800] "GET /.env.dist HTTP/1.1" 404 196 "-" "Mozilla/5.0 ( ... show more 104.28.157.104 - - [27/Oct/2026:13:54:55 +0800] "GET /.env.dist HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-26 21:04:12 (23 hours ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.157.104 - - [24/Oct/2026:01:26:08 +0200] "GET /.env.local HTTP/1.1" 404 5963 "https://www.google.com/search?q=www.jansenbartels.nl" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-26 11:31:48 (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-10-26 07:02:42 (1 day ago)	Web scanner: GET /.env.test	Web App Attack Hacking
🇺🇸 Rip	2026-10-26 06:34:28 (1 day ago)	Authentication attack attempt. CMS Brute Force - Access Forbidden	Brute-Force Web App Attack
🇳🇱 Alt255	2026-10-26 05:56:46 (1 day ago)	[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.157.104 - - [26/Oct/2026:06:56:26 +0100] "GET /wp-config.php.bak HTTP/1.1" 404 7218 "http://tickets.ngurepair.com/wp-config.php.bak" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" ... show less	Bad Web Bot Web App Attack
🇺🇸 mutebot.net	2026-10-26 04:24:29 (1 day ago)	SRC=104.28.157.104, PROTO=TCP, SPT=60110, DPT=1340 SRC=104.28.157.104, PROTO=TCP, SPT=60114, DPT=134 ... show more SRC=104.28.157.104, PROTO=TCP, SPT=60110, DPT=1340 SRC=104.28.157.104, PROTO=TCP, SPT=60114, DPT=1340 SRC=104.28.157.104, PROTO=TCP, SPT=13140, DPT=469 SRC=104.28.157.104, PROTO=TCP, SPT=13841, DPT=459 SRC=104.28.157.104, PROTO=TCP, SPT=12172, DPT=470 show less	Port Scan
🇳🇱 Alt255	2026-10-25 13:38:53 (2 days ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.157.104 - - \[24/Oct/2026:01:26:08 +0200\] "GET /.env.local HTTP/1.1" 404 5963 "https://www.google.com/search\?q=www.jansenbartels.nl" "Mozilla/5.0 AppleWebKit/537.36 $KHTML, like Gecko\; compatible\; ChatGPT-User/1.0\; +https://openai.com/bot$" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-25 00:38:34 (2 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇳🇱 Alt255	2026-10-25 00:09:18 (2 days ago)	[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.157.104 - - [25/Oct/2026:02:09:02 +0200] "GET /.git/config HTTP/1.1" 404 1350 "https://www.google.com/search?q=ti-06.alt255.net" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" ... show less	Bad Web Bot Web App Attack
🇨🇦 Not Fake	2026-10-24 08:45:36 (3 days ago)	$f2bV_matches	Web App Attack
🇫🇮 paissangroup	2026-10-24 03:34:10 (3 days ago)	Multiple WAF Violations	Web App Attack
🇳🇱 Alt255	2026-10-23 07:41:07 (4 days ago)	[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ... show more [ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.157.104 - - \[23/Oct/2026:09:41:01 +0200\] "GET /.env.save HTTP/1.1" 403 5921 "-" "Mozilla/5.0 AppleWebKit/537.36 $KHTML, like Gecko\; compatible\; ChatGPT-User/1.0\; +https://openai.com/bot$" ... show less	Bad Web Bot Web App Attack
🇨🇳 Peter Yu	2026-10-22 23:15:17 (4 days ago)		Bad Web Bot Web App Attack

Showing 1 to 15 of 368 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 153.126.164.138

🇮🇳 103.106.103.218

🇷🇸 77.105.37.219

🇷🇴 2.57.122.238

🇺🇸 216.73.217.95

🇰🇼 188.71.193.80

🇪🇸 185.9.193.111

🇳🇱 45.153.34.117

🇳🇱 45.148.10.157

🇩🇪 2a00:fbc:ea4a:de0a:dc52:beee:dcd7:584b

🇩🇪 2a00:fbc:ea4a:de0a:a568:b388:e35:60d2

🇩🇪 2a00:fbc:ea4a:de0a:d7e:ca24:701b:3254

🇦🇺 223.27.18.80

🇰🇷 221.156.126.1

🇬🇧 188.240.59.25

🇺🇸 161.35.60.140

🇺🇸 147.78.183.203

🇫🇮 80.223.201.173

🇨🇿 78.80.112.134

🇺🇸 68.10.53.106