JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.166.47

104.28.166.47 was found in our database!

This IP was reported 51 times. Confidence of Abuse is 51%: ?

51%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.166.47

Whois 104.28.166.47

IP Abuse Reports for 104.28.166.47:

This IP address has been reported a total of 51 times from 26 distinct sources. 104.28.166.47 was first reported on March 7th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-06-15 08:23:42 (2 days ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 05:34:55 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 104.28.166.47 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.166.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 01:34:51.622703 2026] [security2:error] [pid 10418:tid 10418] [client 104.28.166.47:51551] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "twccsolutions.com"] [uri "/sftp-config.json"] [unique_id "ai-O--v5L-4zFqQan61BPAAAADQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-15 04:37:13 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 104.28.166.47 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.166.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:37:08.422930 2026] [security2:error] [pid 27849:tid 27849] [client 104.28.166.47:51599] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web.cruisingforsex.com"] [uri "/sftp-config.json"] [unique_id "ai-BdMLLhyyC8h2jlR_fIAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇰 www.winos.me	2026-06-14 19:37:35 (2 days ago)	Shield: Layer4 Port 9 Trap	Port Scan Hacking
🇬🇧 consul.to	2026-06-13 18:24:58 (3 days ago)	Web attack/malicious scanning detected	Web App Attack
🇵🇱 skillhost.pl	2026-06-11 04:56:27 (6 days ago)	Automated SSH brute-force attack detected. The IP repeatedly attempted to authenticate to port 22 us ... show more Automated SSH brute-force attack detected. The IP repeatedly attempted to authenticate to port 22 using multiple usernames and password guesses within a short timeframe. show less	Brute-Force SSH
🇺🇸 xxkodedxx	2026-06-03 13:15:46 (1 week ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 2× edge-block in 10 ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 2× edge-block in 10m window. Origin: CA / AS13335 Cloudflare, Inc. Active: 13:15:23→13:15:24 UTC Volume: 2 HTTP req Probed: / Status mix: 444×2 Vhost fishing: 67.217.240.72 UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇫🇮 licen777	2026-05-26 21:28:08 (3 weeks ago)	Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-05-26T21:27:56Z and 2026-05-2 ... show more Cowrie Honeypot: 5 unauthorised SSH/Telnet login attempts between 2026-05-26T21:27:56Z and 2026-05-26T21:28:08Z show less	Brute-Force SSH
Anonymous	2026-05-18 01:15:00 (4 weeks ago)	2026-05-18T03:15:00.192152+02:00 zanati wp(sahpa.co.za)[3144507]: Blocked authentication attempt for ... show more 2026-05-18T03:15:00.192152+02:00 zanati wp(sahpa.co.za)[3144507]: Blocked authentication attempt for [email protected] from 104.28.166.47 ... show less	Web App Attack
🇫🇷 tilellit.pro	2026-05-18 00:22:40 (4 weeks ago)	Fail2Ban banned 104.28.166.47 for security violations in jail wp-armour. Log: 2026/05/18 00:22:39 [e ... show more Fail2Ban banned 104.28.166.47 for security violations in jail wp-armour. Log: 2026/05/18 00:22:39 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 104.28.166.47 \| Target: wplogin" , client: 104.28.166.47, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED] ... show less	Web Spam
🇩🇪 EGP Abuse Dept	2026-05-18 00:14:23 (4 weeks ago)	Scanning for web/db/file exploits on brederaad-010.nl	SQL Injection Bad Web Bot Web App Attack
🇩🇪 piticu iuli	2026-05-18 00:12:43 (4 weeks ago)	(ftpd) Failed FTP login from 104.28.166.47 (HK/Hong Kong/-)	FTP Brute-Force Brute-Force
Anonymous	2026-04-30 10:14:06 (1 month ago)	2026-04-30T12:14:04.863934 biopolis.pcconsultant.it postfix/smtpd[1464897]: warning: unknown[104.28. ... show more 2026-04-30T12:14:04.863934 biopolis.pcconsultant.it postfix/smtpd[1464897]: warning: unknown[104.28.166.47]: SASL PLAIN authentication failed: authentication failure, [email protected] ... show less	Brute-Force
Anonymous	2026-04-29 02:17:37 (1 month ago)	6x Postfix SASL LOGIN authentication failed	Brute-Force
Anonymous	2026-04-28 16:30:29 (1 month ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.245.67.163

🇭🇰 223.197.248.209

🇺🇸 204.116.235.44

🇪🇨 186.68.83.105

🇩🇪 178.27.90.142

🇳🇱 85.11.167.11

🇩🇪 45.135.141.7

🇳🇱 5.61.209.43

🇫🇷 2a10:4646:190::c4d:e84a

🇸🇬 212.73.148.38

🇰🇷 115.91.48.142

🇷🇺 94.180.250.11

🇺🇸 66.132.195.56

🇲🇾 49.124.154.120

🇻🇳 14.191.3.10

🇧🇷 177.129.30.224

🇺🇸 103.203.57.28

🇺🇸 20.9.34.144

🇩🇪 5.231.242.12

🇫🇷 2a02:c206:2163:3416::1