This IP address has been reported a total of
103
times from
64 distinct
sources.
104.28.214.151 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
web application attack (12 malicious requests flagged/blocked by ModSecurity CRS) against 1 server(s ...
show moreweb application attack (12 malicious requests flagged/blocked by ModSecurity CRS) against 1 server(s) in the last hour. Detected by Wazuh SIEM (automatic report).
show less
5 request(s) in 24h for 5 sensitive path(s) that do not exist on this site (e.g. /.env, /.env.backup ...
show more5 request(s) in 24h for 5 sensitive path(s) that do not exist on this site (e.g. /.env, /.env.backup, /.env.local). Automated report from a passive sensor: https://digimasi.com/en/research/methodology/
show less
Web App Attack
Bad Web Bot
Anonymous
Fail2Ban Log Report 104.28.214.151 - - [27/Oct/2026:01:58:55 +0100] "GET /secrets.json HTTP/2.0" 444 ...
show moreFail2Ban Log Report 104.28.214.151 - - [27/Oct/2026:01:58:55 +0100] "GET /secrets.json HTTP/2.0" 444 0 "https://www.google.com/search?q=cvazquez.es" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "104.28.214.151"
104.28.214.151 - - [27/Oct/2026:01:58:55 +0100] "GET /config.json HTTP/2.0" 444 0 "https://www.google.com/search?q=cvazquez.es" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "104.28.214.151"
104.28.214.151 - [27/Oct/2026:01:58:55 +0100] "GET /secrets.json HTTP/2.0" 444 0 "https://www.google.com/search?q=cvazquez.es" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" "-" "104.28.214.151"
104.28.214.151 - [27/Oct/2026:01:58:55 +0100] "GET /config.json HTTP/2.0" 444 0 "https://www.google.com/search?q=cvazquez.es" "Mozilla/5.0 (Macintosh; In
...
show less
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show moreAutomated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: billing.teddypot.site | URI: /.git/config | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot) | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"TH","Cf-Connecting-Ip":"104.28.214.151","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a50cc67d3858ffe4-SIN","Accept-Language":"en-US,en;q=0.9","Accept":"text\/html,
show less
Bad Web Bot
Web App Attack
Anonymous
HTTP scan of URLS detected through requesting more than 5 non existing (sensative) URLs (url file pa ...
show moreHTTP scan of URLS detected through requesting more than 5 non existing (sensative) URLs (url file paths on the same domain)
show less
Brute-Force
Web App Attack
Showing 1 to
15
of 103 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩