JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.197.13

104.28.197.13 was found in our database!

This IP was reported 2,102 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.197.13

Whois 104.28.197.13

IP Abuse Reports for 104.28.197.13:

This IP address has been reported a total of 2,102 times from 756 distinct sources. 104.28.197.13 was first reported on March 11th 2023, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇱🇹 juozaspo	2026-07-15 23:03:27 (3 hours ago)	Automatic Report: Too much requests to non-existing pages in a very short time, auto-banned	Bad Web Bot Web App Attack
🇹🇷 ycoskun41	2026-07-15 22:14:18 (4 hours ago)	fail2ban: plesk-modsecurity jail on genckocaeli.com	Web App Attack
🇿🇦 conure	2026-07-15 21:45:24 (4 hours ago)	csagent: score 20.8: 404 noise floor x3, secrets grab x2; 1 domain(s) in 0s	Web App Attack
🇳🇱 debestelapp	2026-07-15 21:25:06 (5 hours ago)		Web App Attack
🇬🇧 consul.to	2026-07-15 20:58:31 (5 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 kosada.com	2026-07-15 15:17:37 (11 hours ago)	Web vulnerability probing: /.env	Web App Attack
🇺🇸 jcbriar	2026-07-15 15:07:19 (11 hours ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇳🇱 MM-bot	2026-07-15 06:36:20 (20 hours ago)	URL-probe: HTTP/1.1 GET request on /wp-json (2026-07-15 08:36:20 UTC+2)	Web App Attack Hacking
🇬🇷 setupgr	2026-07-15 02:07:42 (1 day ago)	(mod_security) mod_security (id:11000010) triggered by 104.28.197.13 (KR/South Korea/Chungcheongnam- ... show more (mod_security) mod_security (id:11000010) triggered by 104.28.197.13 (KR/South Korea/Chungcheongnam-do/Cheonan-si/-/[AS13335 CLOUDFLARENET]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Jul 15 05:07:41.018623 2026] [security2:error] [pid 997246:tid 997309] [remote 104.28.197.13:56198] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "OAI-SearchBot" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "114"] [id "11000010"] [msg "BLOCKED BOT: OAI-SearchBot on grafeioteletonkaragiannis.gr"] [severity "CRITICAL"] [hostname "grafeioteletonkaragiannis.gr"] [uri "/.aws/config"] [unique_id "albrbQ_LJv0Dtt48ot-s5wAEDAc"] show less	Port Scan
🇩🇪 Holger	2026-07-15 01:02:57 (1 day ago)	Bruteforce WebAttack	Brute-Force Web App Attack
🇮🇹 CoreTech srl	2026-07-15 00:38:58 (1 day ago)	cloudlinux2 fail2ban: 2026-07-15 02:33:48,427 fail2ban.filter [1878]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-07-15 02:33:48,427 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 45.8.19.144 - 2026-07-15 02:33:47cloudlinux2 fail2ban: 2026-07-15 02:33:47,701 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 45.8.19.173 - 2026-07-15 02:33:46cloudlinux2 fail2ban: 2026-07-15 02:34:24,696 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 142.111.152.81 - 2026-07-15 02:34:23cloudlinux2 fail2ban: 2026-07-15 02:34:35,480 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 172.98.32.65 - 2026-07-15 02:34:34cloudlinux2 fail2ban: 2026-07-15 02:34:41,781 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 173.239.211.149 - 2026-07-15 02:34:39cloudlinux2 fail2ban: 2026-07-15 02:34:40,978 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 173.239.211.169 - 2026-07-15 02:34:39cloudlinux2 fail2ban: 2026-07-15 02:34:36,401 fail2ban.filter [1878]: INFO [plesk-wordpress] Found 172.98.32.61 - 2026-07-15 02:34:34cloudlinux show less	Web App Attack
Anonymous	2026-07-15 00:34:17 (1 day ago)	(caddyscan) Scanner path probe from 104.28.197.13 (KR/South Korea/-): 5 in the last 3600 secs; Ports ... show more (caddyscan) Scanner path probe from 104.28.197.13 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.28.197.13 - - [15/Jul/2026:00:34:14 +0000] "GET /.vscode/launch.json HTTP/1.1" [REDACTED] 200 2627 104.28.197.13 - - [15/Jul/2026:00:34:14 +0000] "GET /.ssh/id_ed25519 HTTP/1.1" [REDACTED] 200 2627 104.28.197.13 - - [15/Jul/2026:00:34:14 +0000] "GET /.ssh/id_rsa HTTP/1.1" [REDACTED] 200 2627 104.28.197.13 - - [15/Jul/2026:00:34:14 +0000] "GET /.ssh/id_ecdsa HTTP/1.1" [REDACTED] 200 2627 104.28.197.13 - - [15/Jul/2026:00:34:15 +0000] "GET /.ssh/config HTTP/1.1" show less	Port Scan
🇫🇷 masterguru	2026-07-15 00:13:23 (1 day ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.197.13 (KR/South Korea/-): 1 in the las ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 104.28.197.13 (KR/South Korea/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇨🇭 Origon	2026-07-14 20:21:45 (1 day ago)	http-probing - IP: 104.28.197.13 - time="2026-07-14T22:21:45+02:00" level=info msg="(555f66b4f6a745 ... show more http-probing - IP: 104.28.197.13 - time="2026-07-14T22:21:45+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 104.28.197.13 (DE/13335) : 4h ban on Ip 104.28.197.13" module=db show less	Web App Attack
🇩🇪 FeG Deutschland	2026-07-14 19:52:44 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack

Showing 1 to 15 of 2102 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 43.228.157.8

🇿🇦 2c0f:fb50:4001:5::126

🇬🇧 194.50.235.158

🇵🇪 190.119.63.98

🇮🇳 160.187.250.21

🇺🇸 147.185.132.252

🇻🇳 116.110.18.35

🇺🇸 107.150.110.217

🇫🇷 85.217.140.29

🇸🇦 82.197.48.83

🇺🇸 66.132.195.21

🇸🇦 64.137.205.153

🇰🇷 61.84.211.107

🇳🇱 45.148.10.152

🇳🇱 45.148.10.147

🇧🇪 35.240.95.199

🇬🇧 31.14.254.113

🇬🇧 5.226.140.108

🇩🇪 2a09:bac5:2a92:18f0::27c:112

🇹🇼 218.172.28.222