JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.157.175

Recent Activity

Abuse confidence score ?

41% Elevated

489 reports

268 reporters · latest 7 hours ago

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Reston, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 104.28.157.175

Export CSV

This IP address has been reported a total of 489 times from 268 distinct sources. 104.28.157.175 was first reported on January 1st 2024, and the most recent report was 7 hours ago. In the last 60 days, the top reporter locations were: Netherlands with 6 reports; Germany with 2 reports; Finland with 1 report. The most common categories in these recent reports were: Web App Attack 12 times; Bad Web Bot 8 times; Exploited Host 1 time; Brute-Force 1 time; Phishing 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 neckaralb-admin.de	2026-10-25 23:17:00 (7 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇹🇭 Kriengkrai Chaimin	2026-10-25 14:01:40 (17 hours ago)	104.28.157.175 - - [25/Oct/2026:21:01:38 +0700] "GET /.env.dist HTTP/1.1" 403 548 "https://www.googl ... show more 104.28.157.175 - - [25/Oct/2026:21:01:38 +0700] "GET /.env.dist HTTP/1.1" 403 548 "https://www.google.com/search?q=db114.library.cmu.ac.th" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" "-" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-25 13:04:26 (18 hours ago)	[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ... show more [ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.157.175 - - \[23/Oct/2026:07:50:56 +0200\] "GET /.env.local HTTP/1.1" 301 553 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\; rv:137.0\) Gecko/20100101 Firefox/137.0" ... show less	Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-10-25 12:38:14 (18 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1	Exploited Host Web App Attack
🇳🇱 Alt255	2026-10-25 08:43:07 (22 hours ago)	[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.157.175 - - [25/Oct/2026:09:42:54 +0100] "GET /.git/config HTTP/1.1" 404 2898 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-24 04:30:23 (2 days ago)	[ti-02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.157.175 - - [24/Oct/2026:06:30:14 +0200] "GET /.aws/credentials HTTP/1.1" 404 6071 "https://www.google.com/search?q=www.ide.vos-websites.nl" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-23 05:51:12 (3 days ago)	[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ... show more [ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.157.175 - - \[23/Oct/2026:07:50:56 +0200\] "GET /.env.local HTTP/1.1" 301 553 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\; rv:137.0\) Gecko/20100101 Firefox/137.0" ... show less	Bad Web Bot Web App Attack
🇳🇱 ParaBug	2026-10-22 14:48:42 (3 days ago)	104.28.157.175 - - [22/Oct/2026:16:48:41 +0200] "GET /.env.production HTTP/1.1" 301 499 "https://www ... show more 104.28.157.175 - - [22/Oct/2026:16:48:41 +0200] "GET /.env.production HTTP/1.1" 301 499 "https://www.google.com/search?q=www.antik-wagon.fr" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" ... show less	Phishing Brute-Force Web App Attack
🇳🇱 Alt255	2026-10-22 07:41:02 (3 days ago)	[ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-02ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.157.175 - - [22/Oct/2026:09:40:40 +0200] "GET /.env.save HTTP/1.1" 301 545 "https://www.google.com/search?q=stukadoorsbedrijfrijnmond.nl" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" ... show less	Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-10-19 10:57:23 (6 days ago)	[19/Oct/2026:13:57:23 +0300] -- 104.28.157.175 Ban reason: User-Agent curl/	Bad Web Bot Web App Attack
🇫🇮 paissangroup	2026-08-30 21:03:18 (1 month ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-08-30 12:01:23 (1 month ago)	[30/Aug/2026:12:01:22 +0000] host=lovelyrender.app server=lovelyrender.app ip=104.28.157.175 method= ... show more [30/Aug/2026:12:01:22 +0000] host=lovelyrender.app server=lovelyrender.app ip=104.28.157.175 method=HEAD req=/.env.bak uri=/index.php status=404 bytes=0 rt=0.043 urt=0.043 ref="-" ua="Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" ... show less	Web App Attack Bad Web Bot
🇺🇸 CBJ	2026-08-23 19:20:02 (2 months ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇬🇧 consul.to	2026-08-14 01:10:00 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-07-29 07:00:00 (2 months ago)	Apache probe; attempts=127; exact paths: /xmlrpc.php	Web App Attack

Showing 1 to 15 of 489 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.217

🇧🇷 190.107.93.138

🇧🇷 190.89.55.250

🇰🇷 175.205.251.191

🇹🇭 58.136.243.51

🇺🇸 50.6.201.228

🇩🇪 31.77.15.157

🇺🇸 158.51.96.38

🇧🇪 130.211.61.234

🇺🇸 129.121.143.66

🇳🇱 86.38.187.173

🇧🇬 79.124.58.158

🇺🇸 64.62.197.21

🇸🇬 47.84.136.64

🇧🇷 43.157.175.122

🇺🇸 40.119.42.102

🇰🇷 218.234.186.2

🇺🇸 129.121.98.14

🇧🇩 103.111.35.139

🇨🇦 85.217.149.72