JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.166.128

104.28.166.128 was found in our database!

This IP was reported 81 times. Confidence of Abuse is 64%: ?

64%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Wheaton, Illinois

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.166.128

Whois 104.28.166.128

IP Abuse Reports for 104.28.166.128:

This IP address has been reported a total of 81 times from 55 distinct sources. 104.28.166.128 was first reported on March 7th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 abivia	2026-07-21 05:11:30 (15 hours ago)	Abivia WAF trigger: Rule staticSite: Request PHP file on a static site. uri: /chosen.php?p=	Hacking Web App Attack
Anonymous	2026-07-05 10:28:35 (2 weeks ago)	104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /ms-themes.php HTTP/1.1" 404 1044 "-" "Go-http- ... show more 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /ms-themes.php HTTP/1.1" 404 1044 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /chosen.php?p= HTTP/1.1" 404 1044 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /file.php HTTP/1.1" 404 1038 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /flower.php HTTP/1.1" 404 1041 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /gifclass.php HTTP/1.1" 404 1042 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /bless.php HTTP/1.1" 404 1040 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /class-t.api.php HTTP/1.1" 404 1045 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /blurbs.php HTTP/1.1" 404 1042 "-" "Go-http-client/1.1" 104.28.166.128 - - [05/Jul/2026:12:28:34 +0200] "GET /akcc.php HTTP/1.1" 404 1040 "-" "Go-http-client/1.1" 104.28.166. ... show less	Bad Web Bot Web App Attack
🇪🇸 Francisco Vallejo	2026-07-05 05:12:31 (2 weeks ago)	[Sun Jul 05 07:12:30.443099 2026] [core:info] [pid 2052737:tid 129640131704512] [client 104.28.166.1 ... show more [Sun Jul 05 07:12:30.443099 2026] [core:info] [pid 2052737:tid 129640131704512] [client 104.28.166.128:10291] AH00128: File does not exist: /var/www/franvallejo/gifclass.php, referer: http://www.franvallejo.es/gifclass.php#888xyz999 [Sun Jul 05 07:12:30.689110 2026] [core:info] [pid 2052737:tid 129641121552064] [client 104.28.166.128:10291] AH00128: File does not exist: /var/www/franvallejo/bless.php, referer: http://www.franvallejo.es/bless.php#888xyz999 [Sun Jul 05 07:12:30.932323 2026] [core:info] [pid 2052737:tid 129641138337472] [client 104.28.166.128:10291] AH00128: File does not exist: /var/www/franvallejo/class-t.api.php, referer: http://www.franvallejo.es/class-t.api.php#888xyz999 [Sun Jul 05 07:12:31.174841 2026] [core:info] [pid 2052737:tid 129640114919104] [client 104.28.166.128:10291] AH00128: File does not exist: /var/www/franvallejo/blurbs.php, referer: http://www.franvallejo.es/blurbs.php#888xyz999 [Sun Jul 05 07:12:31.424960 2026] [core:info] [pid 2052737:tid 129641522 ... show less	Brute-Force SSH
🇳🇴 Bots.go.to.hell	2026-07-04 23:24:05 (2 weeks ago)	This IP was detected by CrowdSec triggering custom/http-bad-crawler-ban	Web App Attack Bad Web Bot
🇵🇱 strefapi_com	2026-07-04 15:54:42 (2 weeks ago)	Brute-force on web app ...	Brute-Force Web App Attack
🇩🇪 mravb	2026-07-04 11:15:16 (2 weeks ago)	104.28.166.128 - - [04/Jul/2026:14:15:15 +0300] "GET /wp-admin/admin-ajax.php HTTP/2.0" 404 90181 "h ... show more 104.28.166.128 - - [04/Jul/2026:14:15:15 +0300] "GET /wp-admin/admin-ajax.php HTTP/2.0" 404 90181 "http://cal.michelbaakliny.com/wp-admin/admin-ajax.php" "Go-http-client/2.0" ... show less	Web App Attack Hacking
Anonymous	2026-07-04 10:32:55 (2 weeks ago)	104.28.166.128 - - [04/Jul/2026:12:32:55 +0200] "GET /?p= HTTP/1.1" 301 169 "-" "Go-http-client/1.1"	Bad Web Bot
🇩🇪 BlueWire Hosting	2026-07-04 05:10:16 (2 weeks ago)	Bad bot ignoring robot.txt	Bad Web Bot
🇬🇧 consul.to	2026-07-04 04:01:55 (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-07-04 03:38:21 (2 weeks ago)	104.28.166.128 - - [04/Jul/2026:05:37:50 +0200] "GET /abcd.php HTTP/1.1" 404 125927 "http://www.fast ... show more 104.28.166.128 - - [04/Jul/2026:05:37:50 +0200] "GET /abcd.php HTTP/1.1" 404 125927 "http://www.fastlineclearing.net/abcd.php" "Go-http-client/1.1" 104.28.166.128 - - [04/Jul/2026:05:37:52 +0200] "GET /abcd.php HTTP/1.1" 404 18675 "http://www.fastlineclearing.net/abcd.php" "Go-http-client/1.1" 104.28.166.128 - - [04/Jul/2026:05:37:53 +0200] "GET /shelp.php HTTP/1.1" 404 125940 "http://www.fastlineclearing.net/shelp.php" "Go-http-client/1.1" 104.28.166.128 - - [04/Jul/2026:05:37:55 +0200] "GET /shelp.php HTTP/1.1" 404 18682 "http://www.fastlineclearing.net/shelp.php" "Go-http-client/1.1" 104.28.166.128 - - [04/Jul/2026:05:37:56 +0200] "GET /cord.php HTTP/1.1" 404 125927 "http://www.fastlineclearing.net/cord.php" "Go-http-client/1.1" 104.28.166.128 - - [04/Jul/2026:05:37:58 +0200] "GET /cord.php HTTP/1.1" 404 18673 "http://www.fastlineclearing.net/cord.php" "Go-http-client/1.1" 104.28.166.128 - - [04/Jul/2026:05:37:59 +0200] "GET /dex.php HTTP/1.1" 404 125918 "http://www.fastlineclearing ... show less	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-03 18:41:10 (2 weeks ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-196) show less	Bad Web Bot
🇫🇮 Erpelstolz	2026-07-03 12:00:34 (2 weeks ago)	external host: 104.28.166.128 - - [03/Jul/2026:14:00:34 +0200] "GET /wp-content/plugins/hellopress/w ... show more external host: 104.28.166.128 - - [03/Jul/2026:14:00:34 +0200] "GET /wp-content/plugins/hellopress/wp_mna.php HTTP/1.1" 301 341 "-" "Go-http-client/1.1" CF-Ray:- CF-IP:- show less	Web App Attack
Anonymous	2026-07-02 21:22:02 (2 weeks ago)	Malicious activity detected	Hacking Web App Attack
🇮🇩 Burayot	2026-07-02 10:09:41 (2 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.28.166.128 (US/United States/-) ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.28.166.128 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇫🇷 masterguru	2026-06-30 15:05:27 (3 weeks ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-193) show less	Bad Web Bot

Showing 1 to 15 of 81 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.228

🇨🇳 175.6.109.238

🇺🇸 147.185.132.17

🇺🇸 64.51.19.122

🇮🇳 203.192.213.40

🇺🇸 172.98.33.180

🇺🇸 147.185.132.168

🇮🇳 125.23.203.138

🇬🇧 102.223.185.56

🇷🇺 95.71.127.158

🇻🇳 14.191.36.142

🇨🇳 14.22.23.243

🇳🇱 5.61.209.92

🇺🇸 2a09:bac5:636d:aa::11:181

🇩🇪 216.26.243.50

🇺🇸 205.210.31.40

🇧🇷 131.221.143.206

🇧🇩 114.130.85.36

🇫🇷 109.199.96.200

🇧🇷 45.205.1.247