JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.159.117

104.28.159.117 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 44%: ?

44%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	South Fulton, Georgia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.159.117

Whois 104.28.159.117

IP Abuse Reports for 104.28.159.117:

This IP address has been reported a total of 21 times from 17 distinct sources. 104.28.159.117 was first reported on December 10th 2023, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 CBJ	2026-07-31 05:35:19 (1 hour ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇫🇮 kumiko	2026-07-30 15:48:59 (15 hours ago)	[2026-07-30 18:48:58] Probing for dotfiles "GET /.aws/credentials HTTP/1.1" 403	Bad Web Bot Web App Attack
🇩🇪 Viveronese	2026-07-30 10:54:03 (20 hours ago)	HTTP vulnerability scanning	Web App Attack
🇩🇪 FeG Deutschland	2026-07-29 23:29:54 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-28 22:01:18 (2 days ago)	Auto-ban: >3000 req/min op 2026-07-28	Web App Attack SSH Hacking
🇩🇪 paissangroup	2026-07-28 20:21:34 (2 days ago)	Multiple WAF Violations	Web App Attack
🇩🇪 FeG Deutschland	2026-07-28 09:40:19 (2 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇩🇪 dom4k	2026-07-27 20:43:48 (3 days ago)	104.28.159.117 - - [27/Jul/2026:20:43:34 +0000] "HEAD /.env.dist HTTP/1.1" 444 0 "-" "Mozilla/5.0 Ap ... show more 104.28.159.117 - - [27/Jul/2026:20:43:34 +0000] "HEAD /.env.dist HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" ... show less	Web Spam Bad Web Bot Web App Attack
🇮🇩 xveil	2026-04-15 22:47:48 (3 months ago)	2026-04-16T05:47:46.669780 mail-honeypot postfix/submission/smtpd[28702]: warning: unknown[104.28.15 ... show more 2026-04-16T05:47:46.669780 mail-honeypot postfix/submission/smtpd[28702]: warning: unknown[104.28.159.117]: SASL LOGIN authentication failed: authentication failure ... show less	Brute-Force
🇳🇱 Study Bitcoin 🤗	2024-11-11 15:22:48 (1 year ago)	Port probe to tcp/8 (unassigned) [srv127]	Port Scan
🇳🇱 Study Bitcoin 🤗	2024-11-11 15:20:33 (1 year ago)	Port probe to tcp/8 (unassigned) [srv127]	Port Scan
🇯🇵 zwh	2023-12-12 20:35:29 (2 years ago)	Attack for XMLRPC	Web App Attack
🇺🇸 TPI-Abuse	2023-12-12 13:21:22 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 104.28.159.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.28.159.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 12 08:21:16.391736 2023] [security2:error] [pid 32619] [client 104.28.159.117:19570] [client 104.28.159.117] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.takemehomedogrescue.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.takemehomedogrescue.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZXheTG6kvsAyIVf4wdU9CwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2023-12-12 03:15:33 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 104.28.159.117 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 104.28.159.117 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 11 22:15:27.592113 2023] [security2:error] [pid 2618] [client 104.28.159.117:20957] [client 104.28.159.117] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|sandpointidaho.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "sandpointidaho.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZXfQT_YG53gNPRJFxEfBvgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ps-center	2023-12-12 02:19:05 (2 years ago)	ABV: Web Attack GET /2021/wp-includes/wlwmanifest.xml	Web Spam Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 216.26.237.166

🇧🇷 177.10.46.172

🇺🇸 152.32.236.116

🇨🇳 115.229.130.186

🇨🇳 111.61.67.72

🇮🇳 106.219.123.253

🇻🇳 103.118.28.15

🇬🇧 45.133.173.20

🇯🇵 38.207.136.155

🇻🇳 14.171.142.70

🇺🇸 216.25.89.85

🇨🇦 209.50.177.205

🇺🇸 198.98.53.110

🇷🇺 178.163.7.166

🇺🇸 162.216.150.51

🇺🇸 162.216.150.3

🇺🇸 162.216.149.28

🇮🇳 128.185.56.205

🇻🇳 123.17.58.68

🇻🇳 113.161.164.208