JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.159.230

Neutral Activity

Abuse Confidence Score

0% Low Risk

20 reports

12 reporters · latest 5 months ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇺🇸 United States of America
City: Reston, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

104.28.159.230 has been reported 20 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

20 from 12 distinct reporters

First reported

February 15th 2024

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 prime_fusion_ld	2026-06-14 22:32:59 UTC · (5 months ago)	Blocked by CSF/LFD on vps.primefusion.co.uk. Trigger: 3600 Ports: *	Port Scan
🇺🇸 TPI-Abuse	2026-06-06 16:24:12 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 12:24:07.062027 2026] [security2:error] [pid 27681:tid 27681] [client 104.28.159.230:17738] ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 12:24:07.062027 2026] [security2:error] [pid 27681:tid 27681] [client 104.28.159.230:17738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stindustries.us"] [uri "/.env_secret"] [unique_id "aiRJp_XRDfe8tXjtDbEzRAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-06 15:57:02 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 11:56:54.756496 2026] [security2:error] [pid 11241:tid 11241] [client 104.28.159.230:18196] ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 11:56:54.756496 2026] [security2:error] [pid 11241:tid 11241] [client 104.28.159.230:18196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.saiz.us"] [uri "/src/.env"] [unique_id "aiRDRsp6iei9Ds73peXj7gAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-06 15:40:54 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 11:40:51.403511 2026] [security2:error] [pid 10360:tid 10360] [client 104.28.159.230:17284] ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 06 11:40:51.403511 2026] [security2:error] [pid 10360:tid 10360] [client 104.28.159.230:17284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rahjx.rcto.us"] [uri "/web/.env"] [unique_id "aiQ_g6Ykd2AofuneiJzAOgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 SkyDancer	2026-05-21 10:33:36 UTC · (5 months ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X).	Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-05-20 06:54:36 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 02:54:32.455059 2026] [security2:error] [pid 5702:tid 5702] [client 104.28.159.230:21484] M ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 02:54:32.455059 2026] [security2:error] [pid 5702:tid 5702] [client 104.28.159.230:21484] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.allisonstiles.org"] [uri "/.env.swp"] [unique_id "ag1aqGsiTNHkRmixqo5rNwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 brantknudson.org	2026-05-19 19:52:14 UTC · (5 months ago)	Request path 'GET /.env.prod HTTP/1.1'	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-05-19 05:07:46 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 01:07:38.802163 2026] [security2:error] [pid 23628:tid 23628] [client 104.28.159.230:20863] ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 01:07:38.802163 2026] [security2:error] [pid 23628:tid 23628] [client 104.28.159.230:20863] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.rimaine.org"] [uri "/.env.staging"] [unique_id "agvwGhqMK0PKDb6WLq7mUQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-18 20:05:08 UTC · (5 months ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇩🇪 piticu iuli	2026-05-18 12:31:01 UTC · (5 months ago)	(mod_security) mod_security triggered on hostname [redacted] 104.28.159.230 (US/United States/-)	SQL Injection
🇩🇪 Ba-Yu	2026-05-18 01:58:48 UTC · (5 months ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇬🇧 essinghigh	2026-05-17 22:56:38 UTC · (5 months ago)	IPS Detection: 104.28.159.230 -> DPT: 80	Port Scan
🇮🇳 Genhost	2026-05-17 12:02:17 UTC · (5 months ago)	SCANNING OF PHP SHELL FILES	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-05-17 02:20:59 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 22:20:53.490940 2026] [security2:error] [pid 7210:tid 7210] [client 104.28.159.230:21995] M ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 22:20:53.490940 2026] [security2:error] [pid 7210:tid 7210] [client 104.28.159.230:21995] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.brooklynmeeting.org"] [uri "/.env.swp"] [unique_id "agkmBS5rofa3hnziSE2QHQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-16 17:33:59 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 13:33:52.891681 2026] [security2:error] [pid 31639:tid 31639] [client 104.28.159.230:20839] ... show more (mod_security) mod_security (id:210492) triggered by 104.28.159.230 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 13:33:52.891681 2026] [security2:error] [pid 31639:tid 31639] [client 104.28.159.230:20839] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.h-vpastoralcharge.org"] [uri "/.env.backup"] [unique_id "agiqgJoNC6Gybv2-O9O3YwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 170.168.172.96

🇯🇵 164.52.24.179

🇺🇸 142.93.247.214

🇻🇳 118.70.188.213

🇺🇸 91.230.168.145

🇩🇪 64.89.163.176

🇻🇪 38.224.158.38

🇨🇦 34.118.165.10

🇺🇸 216.218.206.67

🇺🇸 199.165.159.50

🇿🇦 169.255.77.212

🇺🇸 167.99.160.104

🇳🇬 102.220.45.186

🇺🇸 91.230.168.132

🇺🇸 91.230.168.131

🇺🇸 72.215.46.209

🇺🇸 72.215.33.118

🇭🇰 43.155.27.244

🇺🇸 38.146.25.130

🇧🇷 34.39.175.181