104.28.199.133
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- Cloudflare, Inc.
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS13335
- Domain Name
- cloudflare.com
- Country
- 🇲🇽 Mexico
- City
- Monterrey, Nuevo Leon
Abuse Reports
Total reports
70 from
47 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| Anonymous |
Web probing (2 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON.
|
Web App Attack | |
| 🇺🇸 WellSpring |
backup exfil on wellspr.ing/wp-config.php.bak — WellSpr.ing/NetSentinel civic-AI security layer
|
Web App Attack | |
| Anonymous |
Probing for exposed secret / credential files
|
Hacking Web App Attack | |
| 🇳🇱 Alt255 |
|
Bad Web Bot Web App Attack | |
| 🇩🇪 paissangroup |
Multiple WAF Violations
|
Web App Attack | |
| 🇺🇸 infra-monitor |
Automated ban via infra-monitor: suspicious-probe
|
Port Scan | |
| 🇩🇪 ut-addicted.com |
|
Brute-Force Web App Attack | |
| 🇸🇪 1337v411 |
[2026-11-13T04:12:05+00:00] uri="/.git/HEAD" ua="Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
|
Bad Web Bot Web App Attack | |
| 🇩🇪 FeG Deutschland |
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
|
Exploited Host Web App Attack | |
| 🇭🇳 unph |
Malicious probe detected: Repositorio Git expuesto (Method: GET, Probe: /.git/HEAD, UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com)
|
Web App Attack Bad Web Bot | |
| 🇮🇹 CoreTech srl |
[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact
|
Hacking | |
| 🇬🇧 consul.to |
Web attack/malicious scanning detected
|
Web App Attack | |
| Anonymous |
104.28.199.133 - - [12/Nov/2026:19:31:22 +0000] "GET /.env.production HTTP/1.1" 302 4508 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
|
Bad Web Bot Web App Attack | |
| 🇦🇹 SchiWaGoA |
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
|
Web App Attack Bad Web Bot | |
| 🇩🇪 neckaralb-admin.de |
(wordpress) Failed login wp-login.php or xmlrpc.php
|
Web App Attack |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown