JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.164.24

104.28.164.24 was found in our database!

This IP was reported 236 times. Confidence of Abuse is 52%: ?

52%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇨🇦 Canada
City	Mississauga, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.164.24

Whois 104.28.164.24

IP Abuse Reports for 104.28.164.24:

This IP address has been reported a total of 236 times from 155 distinct sources. 104.28.164.24 was first reported on January 21st 2024, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-30 08:19:25 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.28.164.24 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.164.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 04:19:19.547281 2026] [security2:error] [pid 27295:tid 27295] [client 104.28.164.24:43820] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stocks.nautos-usa.com"] [uri "/.env.bak"] [unique_id "akN8B08dZ-MJxFmIZZHSNQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 07:32:05 (9 hours ago)	Bot / scanning and/or hacking attempts: GET /.env~ HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.exam ... show more Bot / scanning and/or hacking attempts: GET /.env~ HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.example HTTP/1.1, GET /.env.sample HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 07:28:53 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.28.164.24 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.164.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:28:47.169227 2026] [security2:error] [pid 22011:tid 22011] [client 104.28.164.24:43400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robertseyewear.com"] [uri "/.env.template"] [unique_id "akNwL_7HYrJkEKUbRpQOkgAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 mysh38	2026-06-30 07:28:29 (9 hours ago)	fail2ban: nginx-bots jail ban	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 07:01:27 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.28.164.24 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.164.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:01:18.004987 2026] [security2:error] [pid 28030:tid 28030] [client 104.28.164.24:43006] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thinkepicbeepic.thinkingepic.com"] [uri "/public/.env"] [unique_id "akNpvtQgtqblqcg7Rj8EygAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 06:53:16 (9 hours ago)	2026/06/30 06:53:15 [error] 2901590#2901590: 30085 [client 104.28.164.24] ModSecurity: Access denie ... show more 2026/06/30 06:53:15 [error] 2901590#2901590: 30085 [client 104.28.164.24] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-4.11.0/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.27.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "idealcollegeonline.org"] [uri "/.env.example"] [unique_id "178280239559.238956"] [ref ""], client: 104.28.164.24, server: idealcollegeonline.org, request: "GET /.env.example HTTP/1.1", host: "idealcollegeonline.org" 2026/06/30 06:53:15 [error] 2901590#2901590: *30085 [client 104.28.164.24] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ... show less	Brute-Force
🇫🇷 masterguru	2026-06-30 06:45:44 (10 hours ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇨🇭 4server	2026-06-30 06:33:46 (10 hours ago)	[TueJun3008:33:42.6698412026][security2:error][pid2126994:tid2127261][client104.28.164.24:0]ModSecur ... show more [TueJun3008:33:42.6698412026][security2:error][pid2126994:tid2127261][client104.28.164.24:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"gamotors.ch.81-17-25-250.cpanel.site\"][uri\"/.env.example\"][unique_id\"akNjRju8enR_82-5ARKn0AAAAQ8\"] show less	Hacking Web App Attack
🇬🇧 consul.to	2026-06-30 06:24:30 (10 hours ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-06-12 21:05:54 (2 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2026-04-04 12:28:33 (2 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇦🇺 MAGIC	2026-03-01 01:21:52 (3 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇷🇺 Agrohim	2026-02-23 15:36:39 (4 months ago)	Gate Inet blocked for categories:	DDoS Attack Ping of Death Port Scan Hacking Brute-Force
🇷🇺 Agrohim	2026-02-19 00:54:16 (4 months ago)	Gate Inet blocked for categories:	DDoS Attack Ping of Death Port Scan Hacking Brute-Force
🇷🇺 Agrohim	2026-02-06 08:41:41 (4 months ago)	Gate Inet blocked for categories:	DDoS Attack Ping of Death Port Scan Hacking Brute-Force

Showing 1 to 15 of 236 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.137

🇺🇸 185.117.225.72

🇳🇱 195.178.110.26

🇬🇧 154.16.44.142

🇮🇳 103.127.30.137

🇨🇳 58.19.77.133

🇱🇺 46.151.182.161

🇺🇸 147.185.132.210

🇺🇸 143.42.1.84

🇰🇷 121.136.93.86

🇺🇸 104.43.131.157

🇧🇩 103.31.10.115

🇺🇸 65.49.20.72

🇮🇳 20.204.97.153

🇬🇧 195.206.182.210

🇳🇱 173.194.170.123

🇮🇩 125.162.180.154

🇲🇽 122.8.184.56

🇭🇰 118.26.37.247

🇨🇳 115.55.198.46