This IP address has been reported a total of
240
times from
104 distinct
sources.
104.28.200.96 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[WedJul2904:30:31.5785492026][security2:error][pid954817:tid954958][client104.28.200.96:0]ModSecurit ...
show more[WedJul2904:30:31.5785492026][security2:error][pid954817:tid954958][client104.28.200.96:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.helvetica-advisors.ch.136-243-54-122.cpanel.site\"][uri\"/.git/config\"][unique_id\"amllxwWy_Gw99n9PHVTKaAAAANY\"]\,referer:https://www.google.com/search\?q=www.helvetica-advisors.ch.136-243-54-122.cpanel.site
show less
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ...
show moreAutomated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
show less
{"ClientAddr":"104.28.200.96:51708","ClientHost":"104.28.200.96","ClientPort":"51708","ClientUsernam ...
show more{"ClientAddr":"104.28.200.96:51708","ClientHost":"104.28.200.96","ClientPort":"51708","ClientUsername":"-","DownstreamContentSize":1058,"DownstreamStatus":200,"Duration":6022813,"OriginContentSize":1058,"OriginDuration":5831200,"OriginStatus":200,"Overhead":191613,"RequestAddr":"cms.kriston.vdkln.com","RequestContentSize":0,"RequestCount":52980,"RequestHost":"cms.kriston.vdkln.com","RequestMethod":"GET","RequestPath":"/admin","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"kriston-cms@docker","ServiceAddr":"172.18.0.56:1337","ServiceName":"kriston-cms@docker","ServiceURL":"http://172.18.0.56:1337","StartLocal":"2026-07-28T10:27:21.231813586Z","StartUTC":"2026-07-28T10:27:21.231813586Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-07-28T10:27:21Z"}
{"ClientAddr":"104.28.200.96:51356","ClientHost":"104.28.200.96","ClientPort":"51356","ClientUsername":"-","Do
...
show less
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.28.200.96 (IN/India/-): 2 in th ...
show moreLF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 104.28.200.96 (IN/India/-): 2 in the last 3600 secs
show less
[MonJul2703:48:47.8156732026][security2:error][pid2634743:tid2635085][client104.28.200.96:0]ModSecur ...
show more[MonJul2703:48:47.8156732026][security2:error][pid2634743:tid2635085][client104.28.200.96:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"mondo-it.ch.81-17-25-250.cpanel.site\"][uri\"/.env.local\"][unique_id\"ama4_25AyLb8kgyy5hj8NQAAAUA\"]\,referer:https://www.google.com/search\?q=mondo-it.ch.81-17-25-250.cpanel.site
show less
[SatJul2504:54:36.0876392026][security2:error][pid3971342:tid3971453][client104.28.200.96:0]ModSecur ...
show more[SatJul2504:54:36.0876392026][security2:error][pid3971342:tid3971453][client104.28.200.96:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.miotrentino.it\"][uri\"/wp-config.php.bak\"][unique_id\"amQlbDkCNgA4W8XbAPHKNQAAAFc\"]\,referer:https://www.google.com/search\?q=www.miotrentino.it
show less
Port Scan
Brute-Force
Web App Attack
Showing 1 to
15
of 240 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩