JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.164.119

104.28.164.119 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 44%: ?

44%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇹🇷 Turkey
City	Bahcelievler, Istanbul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.164.119

Whois 104.28.164.119

IP Abuse Reports for 104.28.164.119:

This IP address has been reported a total of 25 times from 19 distinct sources. 104.28.164.119 was first reported on October 2nd 2025, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Rayulcifer	2026-07-06 21:38:26 (13 hours ago)	[Mon Jul 06 16:35:28.254941 2026] [access_compat:error] [pid 2534088:tid 123146258585280] [client 10 ... show more [Mon Jul 06 16:35:28.254941 2026] [access_compat:error] [pid 2534088:tid 123146258585280] [client 104.28.164.119:23055] AH01797: client denied by server configuration: proxy:http://localhost:4000/ [Mon Jul 06 16:36:15.286853 2026] [access_compat:error] [pid 2566299:tid 123143800735424] [client 104.28.164.119:22583] AH01797: client denied by server configuration: proxy:http://localhost:4000/ [Mon Jul 06 16:36:59.661095 2026] [access_compat:error] [pid 2566299:tid 123147584009920] [client 104.28.164.119:23917] AH01797: client denied by server configuration: proxy:http://localhost:4000/ [Mon Jul 06 16:37:41.730659 2026] [access_compat:error] [pid 2572107:tid 123143783950016] [client 104.28.164.119:24469] AH01797: client denied by server configuration: proxy:http://localhost:4000/ [Mon Jul 06 16:38:25.691062 2026] [access_compat:error] [pid 2572107:tid 123144354391744] [client 104.28.164.119:22739] AH01797: client denied by server configuration: proxy:http://localhost:4000/ ... show less	Brute-Force SSH
🇺🇸 xmission.com	2026-06-19 22:13:16 (2 weeks ago)	Blocked by UFW (TCP on 51413) Source port: 26068 TTL: 56 Packet length: 60 TOS: 0x00 This report (f ... show more Blocked by UFW (TCP on 51413) Source port: 26068 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 104.28.164.119) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 WeekendWeb	2026-06-17 14:54:30 (2 weeks ago)	Wordpress Vunerability attack	Web App Attack
🇺🇸 xmission.com	2026-06-16 13:40:10 (2 weeks ago)	Blocked by UFW (TCP on 123) Source port: 10619 TTL: 56 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 123) Source port: 10619 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 104.28.164.119) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 FeG Deutschland	2026-06-12 07:13:34 (3 weeks ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇬🇧 consul.to	2026-06-12 07:13:28 (3 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 mnsf	2026-06-12 07:05:18 (3 weeks ago)	Scanning/Probing (15)	Brute-Force Web App Attack
🇺🇸 Lee Daniel	2026-06-12 06:48:12 (3 weeks ago)	104.28.164.119 - - [12/Jun/2026:02:48:00 -0400] "GET /wp-content/plugins/datalogics/README.txt HTTP/ ... show more 104.28.164.119 - - [12/Jun/2026:02:48:00 -0400] "GET /wp-content/plugins/datalogics/README.txt HTTP/1.1" 404 40744 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 104.28.164.119 - - [12/Jun/2026:02:48:07 -0400] "GET /wp-content/plugins/wedesigntech-ultimate-booking-addon/changelog.txt HTTP/1.1" 404 40744 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" 104.28.164.119 - - [12/Jun/2026:02:48:08 -0400] "GET /wp-content/plugins/s2member/readme.txt HTTP/1.1" 404 40744 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.58 Mobile Safari/537.36" 104.28.164.119 - - [12/Jun/2026:02:48:10 -0400] "GET /wp-content/plugins/kalrav-ai-agent/readme.txt HTTP/1.1" 404 40744 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" 104.28.164.119 - ... show less	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-06-12 06:47:29 (3 weeks ago)	104.28.164.119 - - [12/Jun/2026:09:47:28 +0300] "GET /wp-content/plugins/ninja-forms-uploads/readme. ... show more 104.28.164.119 - - [12/Jun/2026:09:47:28 +0300] "GET /wp-content/plugins/ninja-forms-uploads/readme.txt HTTP/1.1" 404 628 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.58 Mobile Safari/537.36" 104.28.164.119 - - [12/Jun/2026:09:47:29 +0300] "GET /wp-content/plugins/advanced-custom-post-type/changelog.md HTTP/1.1" 404 628 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 masterguru	2026-06-12 06:45:50 (3 weeks ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.164.119 (CA/Canada/-): 1 in the last 36 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.164.119 (CA/Canada/-): 1 in the last 3600 secs (0-196) show less	Hacking
🇺🇸 TPI-Abuse	2026-06-11 00:47:53 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 104.28.164.119 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 104.28.164.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 20:47:46.042434 2026] [security2:error] [pid 5310:tid 5310] [client 104.28.164.119:12193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.28.164.119 (+1 hits since last alert)\|whodatnation.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "whodatnation.com"] [uri "/xmlrpc.php"] [unique_id "aioFslrNXKZJLp62hdBDGwAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-28 01:25:12 (1 month ago)	XMLRPC BRUTEFORCE - HTTP (Request)	Hacking
🇩🇪 stinpriza	2026-05-22 21:40:01 (1 month ago)	Web App Attack	Web App Attack
🇺🇸 xmission.com	2026-05-22 08:36:10 (1 month ago)	Blocked by UFW (TCP on 123) Source port: 13111 TTL: 56 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 123) Source port: 13111 TTL: 56 Packet length: 60 TOS: 0x00 This report (for 104.28.164.119) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-04-24 07:10:08 (2 months ago)	Blocked by UFW (TCP on 1) Source port: 26071 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 1 ... show more Blocked by UFW (TCP on 1) Source port: 26071 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 104.28.164.119) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 103.58.117.21

🇺🇸 69.73.187.130

🇮🇳 129.159.228.92

🇰🇼 94.128.155.206

🇺🇸 81.30.98.81

🇧🇬 79.124.58.106

🇺🇸 71.6.233.2

🇹🇿 197.186.18.174

🇪🇸 172.68.133.245

🇭🇰 154.221.25.72

🇨🇳 140.250.91.177

🇮🇳 103.209.178.236

🇺🇸 85.8.130.69

🇺🇸 66.132.186.219

🇸🇬 40.78.233.74

🇧🇪 35.205.159.238

🇮🇪 13.105.166.83

🇷🇴 193.46.255.86

🇻🇳 116.99.169.249

🇺🇸 107.23.46.179