JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.158.82

104.28.158.82 was found in our database!

This IP was reported 73 times. Confidence of Abuse is 55%: ?

55%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇪🇸 Spain
City	Chamartin, Castille and Leon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.158.82

Whois 104.28.158.82

IP Abuse Reports for 104.28.158.82:

This IP address has been reported a total of 73 times from 35 distinct sources. 104.28.158.82 was first reported on July 23rd 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 screwlooseit.com.au	2026-06-03 15:43:02 (3 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/-	Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 15:40:53 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 104.28.158.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 104.28.158.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 11:40:50.712757 2026] [security2:error] [pid 17432:tid 17432] [client 104.28.158.82:24243] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|modmove.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "modmove.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiBLAqE6eim1S4sVacQ2nQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-03 14:35:28 (3 days ago)	(wordpress) Failed wordpress login from 104.28.158.82 (ES/Spain/-)	Brute-Force
🇫🇷 masterguru	2026-05-20 09:53:42 (2 weeks ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.158.82 (CA/Canada/-): 1 in the last 360 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.158.82 (CA/Canada/-): 1 in the last 3600 secs (0-196) show less	Hacking
🇩🇪 anycast_ac	2026-05-17 01:01:39 (2 weeks ago)	[mirai-detector] Independently observed gafgyt activity (verdict CONFIRMED_MIRAI, score 150). Active ... show more [mirai-detector] Independently observed gafgyt activity (verdict CONFIRMED_MIRAI, score 150). Active-probe evidence: - [honeypot.replay] tcp/0: honeypot http tcp/8080 from 104.28.158.82:52190 commands: GET /cgi-bin/test.cgi HTTP/1.1 ; CVE-2014-6271 Shellshock bash show less	DDoS Attack IoT Targeted Brute-Force
🇳🇱 Site.eu	2026-05-15 06:59:18 (3 weeks ago)	Excessive multi-domain requests	Brute-Force
🇦🇺 MAGIC	2026-05-12 00:07:19 (3 weeks ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇵🇹 Information Security	2026-05-11 10:15:17 (3 weeks ago)	Web App Attack	Web App Attack
🇱🇻 garmtech.com	2026-05-10 19:38:37 (3 weeks ago)	IM360 WAF: Rate limit exceeded for XMLRPC DoS (fault code)	Web App Attack
🇺🇸 xmission.com	2026-05-10 19:20:50 (3 weeks ago)	Blocked by UFW (TCP on 123) Source port: 61800 TTL: 51 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 123) Source port: 61800 TTL: 51 Packet length: 60 TOS: 0x08 This report (for 104.28.158.82) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇧🇷 chronos	2026-05-03 01:18:43 (1 month ago)	Generic malicious activity: Tentativa de varredura de porta TCP... \| Port: 59601 \| Proto: TCP \| Loca ... show more Generic malicious activity: Tentativa de varredura de porta TCP... \| Port: 59601 \| Proto: TCP \| Location: Spain, Chamartin show less	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-04-26 23:01:14 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.28.158.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.158.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 19:01:09.881886 2026] [security2:error] [pid 11905:tid 11908] [client 104.28.158.82:65079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tamarkummel.com"] [uri "/.env"] [unique_id "ae6ZNUM6jE-KsCPEiPP6QwAAAYE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-26 18:55:20 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.28.158.82 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.158.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 14:55:12.904660 2026] [security2:error] [pid 3808:tid 3808] [client 104.28.158.82:64910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "emsystemsltd.com"] [uri "/.env"] [unique_id "ae5fkHhGh9-pVHbvz0IATwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-04-22 23:08:48 (1 month ago)	Blocked by UFW (TCP on 10226) Source port: 43923 TTL: 50 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 10226) Source port: 43923 TTL: 50 Packet length: 60 TOS: 0x08 This report (for 104.28.158.82) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 EGP Abuse Dept	2026-04-22 10:40:09 (1 month ago)	Scraping webshop URLs (creall.com), likely botnet drone	Bad Web Bot Exploited Host

Showing 1 to 15 of 73 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇬 93.94.141.115

🇳🇿 121.73.162.164

🇺🇸 74.7.228.250

🇱🇹 45.227.254.170

🇳🇱 45.148.10.183

🇬🇧 45.82.76.126

🇳🇱 176.65.139.31

🇩🇪 167.94.145.25

🇨🇳 150.255.181.221

🇺🇸 147.185.132.75

🇨🇳 113.45.160.98

🇸🇬 103.13.206.100

🇫🇷 85.204.70.112

🇺🇸 66.132.195.83

🇨🇦 216.126.86.38

🇺🇸 205.210.31.94

🇮🇷 176.65.238.254

🇨🇳 123.160.235.95

🇨🇦 54.39.203.18

🇨🇳 27.8.127.165