AbuseIPDB » 104.28.159.7

104.28.159.7 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 0%: ?

ISP	CloudFlare Inc.
Usage Type	Content Delivery Network
Domain Name	cloudflare.com
Country	Germany
City	Dreieich, Hessen

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 104.28.159.7

Whois 104.28.159.7

IP Abuse Reports for 104.28.159.7:

This IP address has been reported a total of 35 times from 20 distinct sources. 104.28.159.7 was first reported on October 12th 2023, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2024-08-31 10:04:21 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 104.28.159.7 (-): 1 in the last 300 secs; Ports ... show more(mod_security) mod_security (id:225170) triggered by 104.28.159.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 31 06:04:18.622976 2024] [security2:error] [pid 22791:tid 22791] [client 104.28.159.7:19548] [client 104.28.159.7] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fusionrep.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fusionrep.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZtLqonIFsHavjI_T8PzKugAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-08-31 07:16:54 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 104.28.159.7 (-): 1 in the last 300 secs; Ports ... show more(mod_security) mod_security (id:225170) triggered by 104.28.159.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 31 03:16:49.852132 2024] [security2:error] [pid 5041:tid 5041] [client 104.28.159.7:21212] [client 104.28.159.7] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.airdriedrivingschool.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.airdriedrivingschool.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZtLDYQgjHeuSXGZuk_IMAAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-08-30 19:30:04 (2 weeks ago)	\| CMS (WordPress or Joomla) brute force attempt 10 times (rewritten)	Hacking SQL Injection Web App Attack
TPI-Abuse	2024-08-29 08:17:45 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 104.28.159.7 (-): 1 in the last 300 secs; Ports ... show more(mod_security) mod_security (id:225170) triggered by 104.28.159.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 29 04:17:39.622091 2024] [security2:error] [pid 11720:tid 11847] [client 104.28.159.7:20502] [client 104.28.159.7] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.guitarprimer.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.guitarprimer.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZtAuo930NDYcbmatONkxEQAAAMA"] show less	Brute-Force Bad Web Bot Web App Attack
icp77	2024-08-29 06:05:00 (2 weeks ago)	Abuse DDoS	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Brute-Force Exploited Host Web App Attack SSH
Anonymous	2024-08-15 23:14:22 (1 month ago)	wordpress-trap	Web App Attack
qtland Servers	2024-08-04 05:40:36 (1 month ago)	2024-08-04T05:40:35.712249+00:00 eu-north-sto1 kernel: [993822.176761] honeypot: IN=eth0 OUT= MAC=f2 ... show more2024-08-04T05:40:35.712249+00:00 eu-north-sto1 kernel: [993822.176761] honeypot: IN=eth0 OUT= MAC=f2:3c:94:f6:2a:07:fe:ff:ff:ff:ff:ff:08:00 SRC=104.28.159.7 DST=172.232.157.247 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=65481 DF PROTO=TCP SPT=43271 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Brute-Force SSH
Anonymous	2024-07-16 07:12:00 (2 months ago)	Ports: 80,443; Direction: 1; Trigger: LF_CXS	Brute-Force SSH
Anonymous	2024-07-12 01:04:12 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-07-09 02:58:30 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-06-29 02:55:09 (2 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-06-17 03:40:08 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force Brute-Force SSH SSH
Anonymous	2024-06-09 04:40:52 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-06-08 01:59:44 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-06-05 02:28:24 (3 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH