JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.203.54

104.28.203.54 was found in our database!

This IP was reported 1,349 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Seattle, Washington

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.203.54

Whois 104.28.203.54

IP Abuse Reports for 104.28.203.54:

This IP address has been reported a total of 1,349 times from 172 distinct sources. 104.28.203.54 was first reported on December 2nd 2023, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 micropedro	2026-05-30 00:02:44 (1 week ago)	4 incidents: malicious activity. First: 2026-05-22 19:49, Last: 2026-05-29 20:02 UTC. Triggers: ufw- ... show more 4 incidents: malicious activity. First: 2026-05-22 19:49, Last: 2026-05-29 20:02 UTC. Triggers: ufw-repeater. show less	Port Scan
🇺🇸 micropedro	2026-05-30 00:02:44 (1 week ago)	3 incidents: malicious activity. First: 2026-05-15 19:33, Last: 2026-05-29 20:02 UTC. Triggers: ufw- ... show more 3 incidents: malicious activity. First: 2026-05-15 19:33, Last: 2026-05-29 20:02 UTC. Triggers: ufw-repeater. show less	Port Scan
🇳🇱 Site.eu	2026-05-28 16:38:40 (1 week ago)	Excessive multi-domain requests	Brute-Force
🇵🇱 Kitki30.com	2026-05-28 13:28:29 (1 week ago)	HTTP Probing. Log: 104.28.203.54 - - [28/May/2026:15:28:28 +0200] "GET /wp-admin/admin-ajax.php HTTP ... show more HTTP Probing. Log: 104.28.203.54 - - [28/May/2026:15:28:28 +0200] "GET /wp-admin/admin-ajax.php HTTP/1.1" 301 162 "http://kitki30.tk/wp-admin/admin-ajax.php" "Go-http-client/2.0" show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Starburst SysOp Team	2026-05-27 16:29:09 (1 week ago)	Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 54.203.28.104.rbl.malwa ... show more Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 54.203.28.104.rbl.malware.expert succeeded at REQUEST_HEADERS:x-forwarded-for. (1001000-nue6-2) show less	Hacking
🇬🇧 pinguin	2026-05-27 15:49:26 (1 week ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: /lufix.php UA: Go-http-client/2.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇦🇺 nzhost.co.nz	2026-05-27 13:56:27 (1 week ago)	$f2bV_matches	Hacking Brute-Force
🇮🇳 evicky2002	2026-05-27 06:00:00 (1 week ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇫🇷 MatStef132	2026-05-23 15:48:43 (1 week ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇫🇷 MatStef132	2026-05-21 15:51:12 (2 weeks ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇺🇸 micropedro	2026-05-15 23:33:50 (3 weeks ago)	4 incidents: malicious activity. First: 2026-05-08 18:13, Last: 2026-05-15 19:33 UTC. Triggers: ufw- ... show more 4 incidents: malicious activity. First: 2026-05-08 18:13, Last: 2026-05-15 19:33 UTC. Triggers: ufw-repeater. show less	Port Scan
🇫🇷 cityhunter_rhone	2026-05-15 07:00:09 (3 weeks ago)	Observed at (UTC): 2026-05-06T10:18:13+00:00 \| Mercurius Guide auto detection \| source=Fail2Ban \| sc ... show more Observed at (UTC): 2026-05-06T10:18:13+00:00 \| Mercurius Guide auto detection \| source=Fail2Ban \| scraper score=5 \| events=1 \| decision=datacenter \| actions=fail2ban failed plesk-permanent-ban \| last_seen=2026-05-06 10:18:13 show less	Brute-Force SSH Web App Attack
🇫🇷 cityhunter_rhone	2026-05-14 06:05:13 (3 weeks ago)	Observed at (UTC): 2026-05-06T10:18:13+00:00 \| Mercurius Guide auto detection \| source=Fail2Ban \| sc ... show more Observed at (UTC): 2026-05-06T10:18:13+00:00 \| Mercurius Guide auto detection \| source=Fail2Ban \| scraper score=5 \| events=1 \| decision=datacenter \| actions=fail2ban failed plesk-permanent-ban \| last_seen=2026-05-06 10:18:13 show less	Brute-Force SSH Web App Attack
🇺🇸 Charlesiv	2026-05-13 22:29:40 (3 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 13335 (Cloudflare, Inc.) ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 13335 (Cloudflare, Inc.) Protocol: HTTP/1.1 (GET method) Endpoint: /abcd.php Timestamp: 2026-05-13T13:16:51Z Ray ID: 9fb1f0a56dd8df2f UA: Go-http-client/1.1 show less	Bad Web Bot
🇺🇸 Charlesiv	2026-05-13 14:33:30 (3 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 13335 (Cloudflare, Inc.) ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 13335 (Cloudflare, Inc.) Protocol: HTTP/1.1 (GET method) Endpoint: /cord.php Timestamp: 2026-05-13T13:16:51Z Ray ID: 9fb1f0a58df5df2f UA: Go-http-client/1.1 show less	Bad Web Bot

Showing 1 to 15 of 1349 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 189.194.140.170

🇺🇸 107.174.125.234

🇫🇷 91.196.152.119

🇺🇸 73.36.177.174

🇳🇱 45.153.34.71

🇻🇳 36.50.177.171

🇳🇱 193.176.31.201

🇿🇦 185.132.186.36

🇺🇸 162.216.150.40

🇺🇸 136.49.53.226

🇿🇦 105.224.38.156

🇺🇸 72.253.251.3

🇰🇷 1.245.74.10

🇺🇸 195.184.76.143

🇩🇪 193.124.20.246

🇧🇷 191.241.243.202

🇨🇴 181.51.189.171

🇺🇸 173.252.70.130

🇺🇸 150.107.38.111

🇩🇪 148.251.222.210