JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.159.87

Recent Activity

Abuse Confidence Score

80% Critical

273 reports

81 reporters · latest 53 minutes ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇩🇪 Germany
City: Dreieich, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

273 from 81 distinct reporters

First reported

September 17th 2023

Most recent report

53 minutes ago

Last 60 days

Top reporter locations 🇹🇷 Turkey 14 🇩🇪 Germany 8 🇳🇱 Netherlands 7

Most common categories Web App Attack 37 Hacking 19 Bad Web Bot 11 Brute-Force 8 Exploited Host 3

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Alt255	2026-10-29 03:18:48 (53 minutes ago)	[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [29/Oct/2026:04:18:34 +0100] "GET /wp-config.php.bak HTTP/1.1" 301 5732 "http://www.hdccdoets.com/wp-config.php.bak" "Mozilla/5 ... show more [ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [29/Oct/2026:04:18:34 +0100] "GET /wp-config.php.bak HTTP/1.1" 301 5732 "http://www.hdccdoets.com/wp-config.php.bak" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 Rip	2026-10-28 14:54:09 (13 hours ago)	Restricted File Access Attempts	Port Scan Web App Attack
🇩🇪 neckaralb-admin.de	2026-10-28 03:33:44 (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇳🇱 Alt255	2026-10-27 09:37:24 (1 day ago)	[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [27/Oct/2026:10:37:17 +0100] "GET /wp-config.php.bak HTTP/1.1" 404 7861 "https://www.google.com/search?q=0026.alt255.net" "Mozi ... show more [ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [27/Oct/2026:10:37:17 +0100] "GET /wp-config.php.bak HTTP/1.1" 404 7861 "https://www.google.com/search?q=0026.alt255.net" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" ... show less	Bad Web Bot Web App Attack
🇩🇪 IVski.com	2026-10-27 09:22:47 (1 day ago)	IVski WAF \| Sensitive file probe - looking for exposed .aws/credentials	Hacking Brute-Force Web App Attack
🇩🇪 FeG Deutschland	2026-10-27 08:19:07 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14	Exploited Host Web App Attack
🇳🇱 Alt255	2026-10-26 21:05:31 (2 days ago)	[ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.87 - - [25/Oct/2026:08:23:23 +0100] "GET /.env.sample HTTP/1.1" 404 5892 "https://janpetershorst.nl/.env.sample" "Mozilla/5.0 (Macintosh; Inte ... show more [ti-14al] Web exploit scanning: 2 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.87 - - [25/Oct/2026:08:23:23 +0100] "GET /.env.sample HTTP/1.1" 404 5892 "https://janpetershorst.nl/.env.sample" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 104.28.159.87 - - [25/Oct/2026:08:23:23 +0100] "GET /.env.sample HTTP/1.1" 404 5892 "https://janpetershorst.nl/.env.sample" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-26 07:36:59 (2 days ago)	[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [26/Oct/2026:08:36:48 +0100] "GET /.env.backup HTTP/1.1" 404 6410 "https://www.google.com/search?q=www.karindezoete.nl" "Mozill ... show more [ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [26/Oct/2026:08:36:48 +0100] "GET /.env.backup HTTP/1.1" 404 6410 "https://www.google.com/search?q=www.karindezoete.nl" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-25 20:18:37 (3 days ago)	IP matched detection query bad paths many.	Brute-Force Web App Attack
🇹🇭 Kriengkrai Chaimin	2026-10-25 14:03:38 (3 days ago)	104.28.159.87 - - [25/Oct/2026:21:03:38 +0700] "GET /.env.production.local HTTP/1.1" 403 548 "https://www.google.com/search?q=db214.library.cmu.ac.th" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 ... show more 104.28.159.87 - - [25/Oct/2026:21:03:38 +0700] "GET /.env.production.local HTTP/1.1" 403 548 "https://www.google.com/search?q=db214.library.cmu.ac.th" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-25 07:23:41 (3 days ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.87 - - \[25/Oct/2026:08:23:23 +0100\] "GET /.env.sample HTTP/1.1" 404 5892 "https://janpetershorst.nl/.env.sample" "Mozilla/5.0 \(Macintosh\; ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.159.87 - - \[25/Oct/2026:08:23:23 +0100\] "GET /.env.sample HTTP/1.1" 404 5892 "https://janpetershorst.nl/.env.sample" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-24 22:24:22 (4 days ago)	[ti-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [25/Oct/2026:00:24:03 +0200] "GET /.env.old HTTP/1.1" 404 63972 "https://www.google.com/search?q=pifyn.com" "Mozilla/5.0 (compa ... show more [ti-05al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [25/Oct/2026:00:24:03 +0200] "GET /.env.old HTTP/1.1" 404 63972 "https://www.google.com/search?q=pifyn.com" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Bad Web Bot Web App Attack
🇨🇭 TheCoon	2026-10-24 16:10:47 (4 days ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇨🇭 TheCoon	2026-10-23 06:16:03 (5 days ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇳🇱 Alt255	2026-10-23 04:54:04 (5 days ago)	[testbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [23/Oct/2026:06:53:50 +0200] "GET /.env.save HTTP/1.1" 404 7925 "https://www.google.com/search?q=testadministrator.bdaconnect.nl ... show more [testbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.159.87 - - [23/Oct/2026:06:53:50 +0200] "GET /.env.save HTTP/1.1" 404 7925 "https://www.google.com/search?q=testadministrator.bdaconnect.nl" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 273 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 205.210.31.80

🇳🇱 195.178.110.30

🇺🇸 192.161.56.62

🇨🇱 186.189.111.194

🇸🇦 185.106.244.111

🇮🇳 152.57.112.34

🇭🇰 152.32.189.59

🇪🇸 83.60.95.39

🇳🇱 82.39.86.153

🇳🇱 77.67.26.216

🇺🇸 50.6.110.169

🇺🇸 45.79.145.233

🇬🇧 35.203.210.217

🇮🇶 212.237.122.131

🇳🇱 185.136.15.82

🇸🇪 171.25.158.171

🇮🇩 163.7.8.79

🇳🇱 159.65.197.172

🇺🇸 147.68.1.73

🇵🇭 138.84.140.189