JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.227.185

104.28.227.185 was found in our database!

This IP was reported 638 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.227.185

Whois 104.28.227.185

IP Abuse Reports for 104.28.227.185:

This IP address has been reported a total of 638 times from 265 distinct sources. 104.28.227.185 was first reported on February 21st 2023, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Baltarsar	2026-07-23 06:59:51 (1 hour ago)	JKweb Security: Severe and dangerous web attack detected. Attacker permanently banned by Fail2Ban.	Port Scan Bad Web Bot Web App Attack
🇺🇸 Starburst SysOp Team	2026-07-23 06:58:33 (1 hour ago)	Restricted File Access Attempt. Matched phrase "credentials.json" at REQUEST_FILENAME. (930130-iad5- ... show more Restricted File Access Attempt. Matched phrase "credentials.json" at REQUEST_FILENAME. (930130-iad5-2) show less	Hacking Web App Attack
🇺🇸 Matthew Ping	2026-07-23 05:00:01 (3 hours ago)	ModSecurity rule 949110 triggered on d865. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇩🇪 Ba-Yu	2026-07-23 03:49:18 (4 hours ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
Anonymous	2026-07-23 02:10:55 (6 hours ago)	(caddyscan) Scanner path probe from 104.28.227.185 (NO/Norway/-): 5 in the last 3600 secs; Ports: ; ... show more (caddyscan) Scanner path probe from 104.28.227.185 (NO/Norway/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.28.227.185 - - [23/Jul/2026:02:10:51 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 104.28.227.185 - - [23/Jul/2026:02:10:52 +0000] "GET /.aws/config HTTP/1.1" [REDACTED] 200 2627 104.28.227.185 - - [23/Jul/2026:02:10:52 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 104.28.227.185 - - [23/Jul/2026:02:10:53 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 104.28.227.185 - - [23/Jul/2026:02:10:53 +0000] "GET /.env.local HTTP/1.1" show less	Port Scan
🇫🇮 Kimmo Rieskaniemi	2026-07-22 23:44:05 (8 hours ago)	CrowdSec triggered crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇳🇱 debestelapp	2026-07-22 21:50:05 (10 hours ago)		Web App Attack
🇩🇪 Marc	2026-07-22 21:26:15 (11 hours ago)	104.28.227.185 - - [22/Jul/2026:23:26:02 +0200] "GET /wp-json HTTP/2.0" 404 269 "-" "Mozilla/5.0 App ... show more 104.28.227.185 - - [22/Jul/2026:23:26:02 +0200] "GET /wp-json HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Claude-User/1.0; +mailto:[email protected]" 104.28.227.185 - - [22/Jul/2026:23:26:14 +0200] "GET /.github/workflows/deploy.yml HTTP/2.0" 404 292 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ClaudeBot/1.0; +mailto:[email protected]" 104.28.227.185 - - [22/Jul/2026:23:26:14 +0200] "GET /.gitconfig HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" show less	Brute-Force
🇩🇪 netclix.gr	2026-07-22 17:57:39 (14 hours ago)	(c5_sensitive_scan) Custom5 Sensitive File Exploit Blocked 104.28.227.185 (US/United States/-): 1 in ... show more (c5_sensitive_scan) Custom5 Sensitive File Exploit Blocked 104.28.227.185 (US/United States/-): 1 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: default:80 104.28.227.185 - - [22/Jul/2026:20:56:11 +0300] "GET /credentials.json HTTP/1.1" 404 415 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" show less	Port Scan
🇨🇭 4server	2026-07-22 17:34:36 (15 hours ago)	[WedJul2219:34:30.7930352026][security2:error][pid3419080:tid3419359][client104.28.227.185:0]ModSecu ... show more [WedJul2219:34:30.7930352026][security2:error][pid3419080:tid3419359][client104.28.227.185:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.rs-solution.ch\"][uri\"/.env\"][unique_id\"amD_JtY9-OhT85jyXGYcDgAAAJQ\"] show less	Hacking Web App Attack
🇳🇱 e.fierstra	2026-07-22 17:18:56 (15 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-07-22 16:54:39 (15 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 104.28.227.185 (US/United States/-): ( ... show more (mod_security) mod_security triggered on hostname [redacted] 104.28.227.185 (US/United States/-): (CF_ENABLE) show less	SQL Injection
🇪🇸 alferez	2026-07-22 16:53:26 (15 hours ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇫🇷 masterguru	2026-07-22 16:00:10 (16 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.28.227.185 (NO/Norway/-): 1 in th ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.28.227.185 (NO/Norway/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇳🇱 i-turnradio.nl	2026-07-22 15:53:11 (16 hours ago)	2026-07-22 @ 17:53:10 (CET) ~ Blocked for trying to access: /service-account.json	Web App Attack

Showing 1 to 15 of 638 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 147.185.133.165

🇺🇸 98.159.37.134

🇪🇸 84.246.215.8

🇫🇷 217.128.80.129

🇧🇷 201.32.221.226

🇲🇳 192.82.88.93

🇵🇱 176.53.159.197

🇨🇳 111.228.5.238

🇺🇸 104.131.19.25

🇬🇧 193.8.186.31

🇺🇸 156.232.13.161

🇵🇰 101.50.83.146

🇫🇷 91.231.89.1

🇩🇪 69.5.169.239

🇲🇾 47.250.186.207

🇸🇬 47.84.141.50

🇪🇬 41.238.239.231

🇨🇴 38.191.81.186

🇬🇧 35.203.210.157

🇺🇸 20.64.106.38