JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.159.128

104.28.159.128 was found in our database!

This IP was reported 232 times. Confidence of Abuse is 83%: ?

83%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.159.128

Whois 104.28.159.128

IP Abuse Reports for 104.28.159.128:

This IP address has been reported a total of 232 times from 96 distinct sources. 104.28.159.128 was first reported on March 27th 2023, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇬 securejdprop	2026-07-24 13:53:42 (1 hour ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ETN AGGRESSIVE IPs ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ETN AGGRESSIVE IPs Group 18). show less	Hacking Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-24 11:33:01 (3 hours ago)	Blocked by CSF 13 firewall - Rule: WPLOGIN US/United States/-	Web App Attack
🇮🇩 bps-statistics	2026-07-24 11:01:24 (4 hours ago)	Malicious Access	Brute-Force
🇺🇸 TPI-Abuse	2026-07-19 01:07:06 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 21:06:58.671800 2026] [security2:error] [pid 10378:tid 10378] [client 104.28.159.128:14805] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jwphotodesign.jonathanwilson.me"] [uri "/sftp-config.json"] [unique_id "alwjMnrEWzxQclmVurG_lAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-18 12:41:48 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 08:41:43.822504 2026] [security2:error] [pid 17955:tid 17955] [client 104.28.159.128:15395] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.ds12bonn.de"] [uri "/sftp-config.json"] [unique_id "alt0h-IzqKlOOKV2G8zxQgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 Prcek	2026-07-17 20:50:31 (6 days ago)	PortScan:HOST=104.28.159.128,DPORTS=80,443	Port Scan
🇺🇸 TPI-Abuse	2026-07-17 08:49:54 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:49:50.132022 2026] [security2:error] [pid 12710:tid 12725] [client 104.28.159.128:16270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gemini.pe"] [uri "/sftp-config.json"] [unique_id "alnsrrlAreBh9fiWtFGjrQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-07-17 01:18:45 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-16 20:51:01 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 16:50:56.907754 2026] [security2:error] [pid 5210:tid 5210] [client 104.28.159.128:15784] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.cbrarauco.cl"] [uri "/sftp-config.json"] [unique_id "allEMLLcbEt6YW1zZrkVjgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-16 05:34:23 (1 week ago)	IP banned by Fail2Ban due to multiple malicious requests on Nginx	Brute-Force SSH Web App Attack
Anonymous	2026-07-15 16:31:25 (1 week ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇧🇪 cmbplf	2026-07-15 08:01:09 (1 week ago)	1.001 requests to many distinct domains in 1 hour (4w5h59s)	Brute-Force Bad Web Bot
🇺🇸 IndigoRidge	2026-07-14 02:46:47 (1 week ago)	104.28.159.128 - - [13/Jul/2026:22:46:46 -0400] "GET /wp-login.php HTTP/1.1" 301 162 "-" "Mozilla/5. ... show more 104.28.159.128 - - [13/Jul/2026:22:46:46 -0400] "GET /wp-login.php HTTP/1.1" 301 162 "-" "Mozilla/5.0" 104.28.159.128 - - [13/Jul/2026:22:46:46 -0400] "GET /wp-login.php HTTP/1.1" 301 162 "-" "Mozilla/5.0" 104.28.159.128 - - [13/Jul/2026:22:46:46 -0400] "GET /wp-login.php HTTP/1.1" 301 162 "-" "Mozilla/5.0" 104.28.159.128 - - [13/Jul/2026:22:46:46 -0400] "GET /wp-login.php HTTP/1.1" 301 162 "-" "Mozilla/5.0" 104.28.159.128 - - [13/Jul/2026:22:46:46 -0400] "GET /wp-login.php HTTP/1.1" 301 162 "-" "Mozilla/5.0" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 21:35:30 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 104.28.159.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 17:35:26.990178 2026] [security2:error] [pid 5917:tid 5917] [client 104.28.159.128:56178] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.28.159.128 (+1 hits since last alert)\|eefinchco.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "eefinchco.com"] [uri "/xmlrpc.php"] [unique_id "alQIns21Pk5gDr-UTYoqZAAAADE"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇴 clauss	2026-07-08 23:13:59 (2 weeks ago)	IP reached maximum auth failures for a one day block	Brute-Force

Showing 1 to 15 of 232 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.170

🇳🇱 195.178.110.137

🇺🇸 152.32.208.56

🇰🇷 59.24.133.197

🇺🇸 45.156.129.52

🇬🇧 45.67.85.190

🇦🇷 186.13.115.220

🇮🇹 151.115.164.43

🇺🇸 135.148.103.15

🇵🇰 124.29.194.7

🇯🇵 111.238.174.6

🇨🇦 85.217.149.72

🇺🇸 66.132.224.18

🇸🇬 47.84.135.203

🇨🇦 45.194.92.14

🇳🇱 45.148.10.141

🇩🇪 4.185.41.66

🇹🇼 198.235.24.108

🇺🇦 194.187.155.253

🇨🇳 180.76.239.185