JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.195.191

104.28.195.191 was found in our database!

This IP was reported 57 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.195.191

Whois 104.28.195.191

IP Abuse Reports for 104.28.195.191:

This IP address has been reported a total of 57 times from 33 distinct sources. 104.28.195.191 was first reported on February 27th 2023, and the most recent report was 4 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 burlacu.org	2026-07-23 00:27:01 (4 minutes ago)	Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 2 attempts ... show more Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 2 attempts. Blocked automatically. show less	Web App Attack Bad Web Bot
Anonymous	2026-07-22 22:15:53 (2 hours ago)	(caddyscan) Scanner path probe from 104.28.195.191 (NO/Norway/-): 5 in the last 3600 secs; Ports: ; ... show more (caddyscan) Scanner path probe from 104.28.195.191 (NO/Norway/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.28.195.191 - - [22/Jul/2026:22:15:50 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 104.28.195.191 - - [22/Jul/2026:22:15:51 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 104.28.195.191 - - [22/Jul/2026:22:15:51 +0000] "GET /.aws/config HTTP/1.1" [REDACTED] 200 2627 104.28.195.191 - - [22/Jul/2026:22:15:52 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 104.28.195.191 - - [22/Jul/2026:22:15:52 +0000] "GET /.env.production HTTP/1.1" show less	Port Scan
🇮🇹 CoreTech srl	2026-07-22 06:43:57 (17 hours ago)	cloudlinux2 fail2ban: 2026-07-22 08:39:03,101 fail2ban.filter [1589]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-07-22 08:39:03,101 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 104.28.195.191 - 2026-07-22 08:39:03cloudlinux2 fail2ban: 2026-07-22 08:39:06,462 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 104.28.195.191 - 2026-07-22 08:39:06cloudlinux2 fail2ban: 2026-07-22 08:39:04,744 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 104.28.195.191 - 2026-07-22 08:39:04cloudlinux2 fail2ban: 2026-07-22 08:39:06,712 fail2ban.actions [1589]: NOTICE [plesk-modsecurity] Ban 104.28.195.191cloudlinux2 fail2ban: 2026-07-22 08:39:06,718 fail2ban.filter [1589]: INFO [recidive] Found 104.28.195.191 - 2026-07-22 08:39:06cloudlinux2 fail2ban: 2026-07-22 08:40:26,267 fail2ban.filter [1589]: INFO [plesk-wordpress] Found 45.132.227.30 - 2026-07-22 08:40:25cloudlinux2 fail2ban: 2026-07-22 08:41:16,081 fail2ban.actions [1589]: NOTICE [plesk-modsecurity] Unban 212.34.23.115cloudlinux2 fail2ban: 2026-07-22 08:41:10,215 f show less	FTP Brute-Force Web App Attack
🇳🇱 javierin	2026-07-22 05:34:35 (18 hours ago)	104.28.195.191 - console.javierin.com - - [22/Jul/2026:05:34:33 +0000] "GET / HTTP/2.0" 200 4557 "-" ... show more 104.28.195.191 - console.javierin.com - - [22/Jul/2026:05:34:33 +0000] "GET / HTTP/2.0" 200 4557 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0" 104.28.195.191 - console.javierin.com - - [22/Jul/2026:05:34:34 +0000] "GET /.aws/credentials HTTP/2.0" 404 2509 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-SearchBot/1.0; +mailto:[email protected]" ... show less	Web App Attack Hacking
🇨🇱 SinaiCL	2026-07-22 03:55:13 (20 hours ago)	WAF Multiple Hits	Bad Web Bot Web App Attack
Anonymous	2026-07-22 03:02:02 (21 hours ago)	[_admin] auto-suppressed-foreign: auto: foreign suppressed offender [US, cloudflare-shared-egress]	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 00:24:22 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 104.28.195.191 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 104.28.195.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 20:24:18.918116 2026] [security2:error] [pid 85881:tid 85881] [client 104.28.195.191:12556] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|oauth.kemela.com\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "oauth.kemela.com"] [uri "/rclone.conf"] [unique_id "amANsj0Dk_HXPbTOITZYJAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xpto	2026-07-21 23:31:11 (1 day ago)	Blocked for probing for web application vulnerabilities	Web App Attack
🇮🇹 alessio loto	2026-07-21 20:04:28 (1 day ago)	WAF Detection: Security_Scanner_Blocked (High Risk IP). AI Confirmed Attack Payload.	Bad Web Bot
🇮🇩 Burayot	2026-07-21 18:29:55 (1 day ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 104.28.195.191 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 104.28.195.191 (US/United States/-): 1 in the last 3600 secs show less	Web App Attack
🇵🇱 dzpk	2026-07-21 18:29:11 (1 day ago)	104.28.195.191 - - [21/Jul/2026:20:29:10 +0200] "GET /wp-json HTTP/2.0" 404 258 "-" "Mozilla/5.0 (co ... show more 104.28.195.191 - - [21/Jul/2026:20:29:10 +0200] "GET /wp-json HTTP/2.0" 404 258 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" show less	Bad Web Bot Web App Attack
🇩🇪 Marc	2026-07-21 18:27:33 (1 day ago)	104.28.195.191 - - [21/Jul/2026:20:27:33 +0200] "GET /.gitconfig HTTP/2.0" 404 314 "-" "Mozilla/5.0 ... show more 104.28.195.191 - - [21/Jul/2026:20:27:33 +0200] "GET /.gitconfig HTTP/2.0" 404 314 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 104.28.195.191 - - [21/Jul/2026:20:27:33 +0200] "GET /.git/HEAD HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Diffbot/1.0; +https://diffbot.com)" 104.28.195.191 - - [21/Jul/2026:20:27:33 +0200] "GET /.git/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected])" show less	Brute-Force
🇳🇱 e.fierstra	2026-07-21 17:46:27 (1 day ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 grassau.com	2026-07-21 07:54:42 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 104.28.195.191 (US/United States/Califo ... show more (mod_security) mod_security triggered on hostname [redacted] 104.28.195.191 (US/United States/California/Los Angeles/-) show less	SQL Injection
Anonymous	2026-07-20 16:31:33 (2 days ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host

Showing 1 to 15 of 57 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.80

🇸🇳 196.207.222.89

🇱🇹 81.30.98.47

🇺🇸 47.251.67.227

🇹🇭 1.4.151.100

🇧🇷 2804:1b3:6503:3c84:f43b:9a4c:946:2083

🇺🇸 216.25.89.121

🇬🇧 198.244.183.217

🇩🇪 193.124.20.253

🇨🇱 187.15.83.60

🇵🇱 176.53.159.197

🇧🇷 170.231.235.70

🇺🇸 162.216.150.110

🇫🇷 91.231.89.205

🇺🇸 91.230.168.186

🇷🇺 78.31.5.1

🇺🇸 66.132.186.208

🇳🇱 45.148.10.147

🇸🇳 41.214.55.235

🇺🇸 35.188.254.48