JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.163.117

104.28.163.117 was found in our database!

This IP was reported 140 times. Confidence of Abuse is 66%: ?

66%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇫🇷 France
City	Aulnay-sous-Bois, Ile-de-France

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.163.117

Whois 104.28.163.117

IP Abuse Reports for 104.28.163.117:

This IP address has been reported a total of 140 times from 70 distinct sources. 104.28.163.117 was first reported on March 24th 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-07-01 00:24:52 (1 hour ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇺🇸 lime	2026-06-30 17:26:02 (8 hours ago)	104.28.163.117 - - [30/Jun/2026:17:26:01 +0000] "GET /config.env HTTP/1.1" 404 466 "-" "Mozilla/5.0 ... show more 104.28.163.117 - - [30/Jun/2026:17:26:01 +0000] "GET /config.env HTTP/1.1" 404 466 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" show less	Hacking Web App Attack
🇩🇪 ger-stg-sifi1	2026-06-30 16:22:44 (9 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 updown.io	2026-06-30 02:02:08 (1 day ago)	{"level":"info","ts":1782784926.8179424,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1782784926.8179424,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.28.163.117","remote_port":"31045","client_ip":"104.28.163.117","proto":"HTTP/2.0","method":"GET","host":"demo.updown.io","uri":"/.git/config","headers":{"User-Agent":["Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"demo.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000619175,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}} {"level":"info","ts":1782784926.818759,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.28.163.117","remote_port":"31045","client_ip":"104.28.163.117","proto":"HTTP/2.0","method":"GET","host":"demo.updown.io","uri":"/config/secrets.yml","headers":{"User-Agent":["Mozilla/5.0 (compatible; ... show less	DDoS Attack Web App Attack
🇳🇱 e.fierstra	2026-06-29 12:21:02 (1 day ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇺🇸 mccsoft.io	2026-06-27 14:25:15 (3 days ago)	Web application attack / vulnerability scanning. Source sent 24 HTTP request(s) (24 distinct paths) ... show more Web application attack / vulnerability scanning. Source sent 24 HTTP request(s) (24 distinct paths) to our public nginx web server on TCP 80/443, probing blocked/sensitive paths; all returned HTTP 444 (connection closed by security rule, jail nginx-444). Sample requests: GET /admin/.env \| GET /api/.env \| GET /app/.env \| GET /backend/.env \| GET /config.env. User-Agent: Mozilla/5.0 (compatible; Claude-Web/1.0; +https://www.anthropic.com). Observed 2026-06-27 14:24:54 to 2026-06-27 14:25:00 UTC. TCP handshake completed (requests fully received). Categories: Web App Attack / Bad Web Bot. show less	Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-06-27 04:15:16 (3 days ago)	Aggressive web search of vulnerable pages: /.env /.env.local /application.yml /.env.local /.env /app ... show more Aggressive web search of vulnerable pages: /.env /.env.local /application.yml /.env.local /.env /app/.env /public/.env ... show less	Web App Attack
🇫🇷 Little Iguana	2026-06-27 03:22:41 (3 days ago)	Attempt to hack Wordpress Login, XMLRPC or other login	Hacking
🇬🇧 Smish	2026-06-27 03:04:37 (3 days ago)	HONEYPOT HIT --> Fail2ban time=1782529475 log=2026-06-27T04:04:35+01:00 ip=104.28.163.117 host=as210 ... show more HONEYPOT HIT --> Fail2ban time=1782529475 log=2026-06-27T04:04:35+01:00 ip=104.28.163.117 host=as210667.net method=GET uri="/vault.env" status=404 ua="Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com)" ref="-" rid=f1bb9f17b8b46f773cf88fa784c1ee39 show less	Web App Attack
🇸🇪 vaia.cloud	2026-06-17 02:03:05 (2 weeks ago)	trying wp-login.php/xmlrpc.php 32 times in 1 minutes	Brute-Force Web App Attack
🇫🇷 dynamix	2026-06-17 00:59:28 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
Anonymous	2026-05-26 04:31:26 (1 month ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
Anonymous	2026-05-04 14:50:58 (1 month ago)	Authentication failure	Brute-Force
Anonymous	2026-05-03 22:04:21 (1 month ago)	RdpGuard detected brute-force attempt on SMTP	Brute-Force
🇩🇪 Paul Smith	2026-05-01 05:39:13 (1 month ago)	Email Auth Brute force attack 2/1 in last day	Brute-Force

Showing 1 to 15 of 140 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 148.240.238.3

🇺🇸 47.77.231.127

🇺🇸 2001:470:2cc:1::298

🇮🇳 206.189.138.228

🇧🇷 205.210.31.213

🇧🇷 201.33.81.63

🇷🇴 193.46.255.86

🇩🇪 159.89.4.86

🇻🇳 157.10.45.70

🇺🇸 137.184.105.109

🇰🇷 125.141.231.18

🇮🇩 118.99.76.196

🇨🇳 115.231.126.19

🇫🇷 91.231.89.56

🇹🇿 41.93.82.194

🇬🇧 37.10.113.218

🇺🇸 172.202.104.166

🇭🇰 165.154.245.138

🇦🇺 162.43.180.97

🇺🇸 147.185.132.246