JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.164.103

104.28.164.103 was found in our database!

This IP was reported 69 times. Confidence of Abuse is 79%: ?

79%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇹🇷 Turkey
City	Bahcelievler, Istanbul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.164.103

Whois 104.28.164.103

IP Abuse Reports for 104.28.164.103:

This IP address has been reported a total of 69 times from 49 distinct sources. 104.28.164.103 was first reported on May 24th 2025, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 jormaster3k	2026-07-12 10:53:38 (18 hours ago)	Attack against Apache (too many 404s)	Web App Attack
🇬🇧 Oakley	2026-07-12 07:02:29 (22 hours ago)	(confirmed_bot_sig) Confirmed bot	Hacking
🇭🇺 kranem	2026-07-10 18:00:27 (2 days ago)	Triggered Cloudflare WAF from TR. Action taken: BLOCK ASN: 13335 (Cloudflare, Inc.) Protocol: HTTP/1 ... show more Triggered Cloudflare WAF from TR. Action taken: BLOCK ASN: 13335 (Cloudflare, Inc.) Protocol: HTTP/1.1 (GET method) Endpoint: /auth/login/wp-login.php Timestamp: 2026-07-10T16:27:42Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 show less	Bad Web Bot
🇬🇷 setupgr	2026-07-06 18:19:17 (6 days ago)	(XMLRPC) WP XMLRPC Attack 104.28.164.103 (CA/Canada/Ontario/Toronto/-/[AS13335 CLOUDFLARENET]): 1 in ... show more (XMLRPC) WP XMLRPC Attack 104.28.164.103 (CA/Canada/Ontario/Toronto/-/[AS13335 CLOUDFLARENET]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.28.164.103 - - [06/Jul/2026:21:17:47 +0300] "POST /xmlrpc.php HTTP/1.1" 503 18932 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" show less	Port Scan
🇫🇷 masterguru	2026-07-06 17:56:55 (6 days ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇩🇪 big-cloud.nl	2026-07-06 17:51:05 (6 days ago)	Try to access /xmlrpc.php	Web App Attack
🇪🇸 masterguru	2026-07-04 07:03:55 (1 week ago)	(xmlrpc) Failed xmlrpc access from 104.28.164.103 (CA/Canada/-): 5 in the last 3600 secs (0-122)	Hacking
🇺🇸 kosada.com	2026-07-03 11:49:25 (1 week ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇮🇩 Burayot	2026-07-03 00:56:05 (1 week ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.28.164.103 (TR/Türkiye/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.28.164.103 (TR/Türkiye/-): 1 in the last 3600 secs show less	Web App Attack
Anonymous	2026-06-29 16:05:23 (1 week ago)	[redacted] 104.28.164.103 - - [29/Jun/2026:18:04:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" " ... show more [redacted] 104.28.164.103 - - [29/Jun/2026:18:04:38 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack/13.0; WordPress/6.2; http://site29646174.com" [redacted] 104.28.164.103 - - [29/Jun/2026:18:04:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.2)" [redacted] 104.28.164.103 - - [29/Jun/2026:18:05:00 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 104.28.164.103 - - [29/Jun/2026:18:05:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 104.28.164.103 - - [29/Jun/2026:18:05:21 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2)" ... show less	Hacking Web App Attack
🇩🇪 Vegascosmetics	2026-06-15 12:59:45 (3 weeks ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇯🇵 demonsword	2026-06-15 12:14:38 (3 weeks ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: httpbin.org:443 show less	Open Proxy Port Scan
🇺🇸 xmission.com	2026-06-14 17:04:30 (4 weeks ago)	Blocked by UFW (TCP on 123) Source port: 18628 TTL: 56 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 123) Source port: 18628 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 104.28.164.103) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 ShadowWhisperer	2026-06-13 17:42:36 (4 weeks ago)	exploit - rce (Redis unauthenticated persistence write (cron)) [cron, persistence, rce, redis, docke ... show more exploit - rce (Redis unauthenticated persistence write (cron)) [cron, persistence, rce, redis, docker] show less	Port Scan
🇫🇷 masterguru	2026-06-12 06:30:25 (1 month ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.164.103 (CA/Canada/-): 1 in the last 36 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.164.103 (CA/Canada/-): 1 in the last 3600 secs (0-196) show less	Hacking

Showing 1 to 15 of 69 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.255

🇺🇸 157.230.191.249

🇭🇰 119.28.181.155

🇰🇭 58.97.216.140

🇧🇷 189.56.123.67

🇫🇷 163.172.143.147

🇺🇸 147.185.132.43

🇹🇷 95.3.77.254

🇳🇱 91.92.40.5

🇺🇸 64.186.225.60

🇯🇵 43.165.178.246

🇺🇸 20.15.225.33

🇮🇩 202.145.0.61

🇳🇱 185.223.235.4

🇹🇭 159.192.144.204

🇭🇰 103.243.24.124

🇺🇸 76.79.213.69

🇨🇳 60.166.83.38

🇮🇳 49.206.194.29

🇨🇳 39.144.125.62