JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.159.5

Activity Trending Down

Abuse Confidence Score

57% Elevated

221 reports

83 reporters · latest 2 weeks ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇩🇪 Germany
City: Dreieich, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

221 from 83 distinct reporters

First reported

April 17th 2023

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇳🇱 Netherlands 10 🇩🇪 Germany 6 🇺🇸 United States of America 3

Most common categories Web App Attack 16 Bad Web Bot 8 Port Scan 4 Hacking 3 SSH 2

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Alt255	2026-10-31 08:25:45 UTC · (2 weeks ago)	[cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.5 - - [31/Oct/2026:09:25:32 +0100] "GET /.env.development.local HTTP/1.1" 404 1350 "https://www.google.com/search?q=ttt-ai.nl" "Mozill ... show more [cb-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.5 - - [31/Oct/2026:09:25:32 +0100] "GET /.env.development.local HTTP/1.1" 404 1350 "https://www.google.com/search?q=ttt-ai.nl" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-30 00:38:05 UTC · (2 weeks ago)	[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.5 - - \[30/Oct/2026:01:37:49 +0100\] "GET /.git/config HTTP/1.1" 301 5876 "https://www.google.com/search\?q=pipportal.nl" "Mozilla/5.0 \(comp ... show more [ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.5 - - \[30/Oct/2026:01:37:49 +0100\] "GET /.git/config HTTP/1.1" 301 5876 "https://www.google.com/search\?q=pipportal.nl" "Mozilla/5.0 \(compatible\; Googlebot/2.1\; +http://www.google.com/bot.html\)" ... show less	Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-10-29 23:01:08 UTC · (2 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-28.	Web App Attack SSH Hacking
Anonymous	2026-10-29 04:32:18 UTC · (2 weeks ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
Anonymous	2026-10-28 22:02:27 UTC · (2 weeks ago)	apache vulnerability scan	Web App Attack
🇳🇱 Alt255	2026-10-28 21:22:25 UTC · (2 weeks ago)	[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.5 - - [28/Oct/2026:22:22:20 +0100] "GET /.env.dist HTTP/1.1" 301 425 "https://www.google.com/search?q=www.fot010.nl" "Mozilla/5.0 (Win ... show more [ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.5 - - [28/Oct/2026:22:22:20 +0100] "GET /.env.dist HTTP/1.1" 301 425 "https://www.google.com/search?q=www.fot010.nl" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-28 21:14:21 UTC · (2 weeks ago)	104.28.159.5 - - [28/Oct/2026:22:14:21 +0100] "GET /. HTTP/1.1" 301 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https:///bot)"	Web App Attack
🇳🇱 BlueWire Hosting	2026-10-28 20:54:14 UTC · (2 weeks ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇳🇱 Alt255	2026-10-28 10:47:15 UTC · (2 weeks ago)	[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.5 - - \[28/Oct/2026:11:46:56 +0100\] "GET /.env.old HTTP/1.1" 404 8001 "https://www.google.com/search\?q=staging2.sailing.nl" "Mozilla/5.0 \(c ... show more [ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.5 - - \[28/Oct/2026:11:46:56 +0100\] "GET /.env.old HTTP/1.1" 404 8001 "https://www.google.com/search\?q=staging2.sailing.nl" "Mozilla/5.0 \(compatible\; Googlebot/2.1\; +http://www.google.com/bot.html\)" ... show less	Bad Web Bot Web App Attack
🇺🇸 CBJ	2026-10-27 06:30:00 UTC · (2 weeks ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇩🇪 FeG Deutschland	2026-10-26 21:41:05 UTC · (2 weeks ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14	Exploited Host Web App Attack
🇳🇱 Alt255	2026-10-26 15:25:25 UTC · (2 weeks ago)	[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.5 - - [26/Oct/2026:16:25:22 +0100] "GET /.env.dist HTTP/1.1" 301 4519 "https://www.google.com/search?q=alt255.nl" "Mozilla/5.0 (compat ... show more [ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.5 - - [26/Oct/2026:16:25:22 +0100] "GET /.env.dist HTTP/1.1" 301 4519 "https://www.google.com/search?q=alt255.nl" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Bad Web Bot Web App Attack
🇳🇱 ipoac.nl	2026-10-26 05:04:36 UTC · (2 weeks ago)	ipoac.nl:80 104.28.159.5 - - [26/Oct/2026:06:04:35 +0100] ipoac.nl "GET /.git/HEAD HTTP/1.1" 403 1702 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)"	Bad Web Bot
🇩🇪 neckaralb-admin.de	2026-10-26 01:39:19 UTC · (2 weeks ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-10-25 21:34:10 UTC · (2 weeks ago)	Web scanner: GET /.git/HEAD	Web App Attack Hacking

Showing 1 to 15 of 221 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 207.244.253.63

🇧🇪 34.62.9.55

🇺🇸 2400:cb00:719:1000:494b:595a:4250:8301

🇺🇸 185.198.240.75

🇨🇳 120.26.220.254

🇰🇷 118.193.69.235

🇪🇸 85.60.36.223

🇩🇪 69.5.169.63

🇺🇸 68.10.53.88

🇺🇸 34.132.1.5

🇩🇪 109.160.32.36

🇺🇸 70.175.182.57

🇰🇷 211.54.103.121

🇳🇱 195.178.110.78

🇬🇧 134.65.62.240

🇵🇱 94.26.68.131

🇫🇷 91.196.152.39

🇺🇦 37.221.143.80

🇧🇪 34.156.64.247

🇧🇪 34.79.135.70