JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.227.192

104.28.227.192 was found in our database!

This IP was reported 60 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.227.192

Whois 104.28.227.192

IP Abuse Reports for 104.28.227.192:

This IP address has been reported a total of 60 times from 45 distinct sources. 104.28.227.192 was first reported on February 12th 2023, and the most recent report was 28 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-07-23 03:33:38 (28 minutes ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇫🇮 Christopher Hughes	2026-07-23 02:31:04 (1 hour ago)	104.28.227.192 - - [23/Jul/2026:03:31:04 +0100] "GET /.claude.json HTTP/2.0" 404 247 "-" "Mozilla/5. ... show more 104.28.227.192 - - [23/Jul/2026:03:31:04 +0100] "GET /.claude.json HTTP/2.0" 404 247 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇪🇸 alferez	2026-07-23 02:14:19 (1 hour ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇬🇧 OptimusGO	2026-07-23 02:11:31 (1 hour ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-07-23 03:11:31 UTC Log evidence: 104.28.227.192 - - [23/Jul/2026:03:11:30 +0100] "GET /service-account.json HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0" 104.28.227.192 - - [23/Jul/2026:03:11:30 +0100] "GET /serviceAccountKey.json HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0" 104.28.227.192 - - [23/Jul/2026:03:11:30 +0100] "GET /credentials.json HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0" show less	Port Scan Brute-Force
Anonymous	2026-07-23 02:08:53 (1 hour ago)	104.28.227.192 - - [23/Jul/2026:04:07:58 +0200] "GET /config.php.bak HTTP/2.0" 403 106 "-" "Mozilla/ ... show more 104.28.227.192 - - [23/Jul/2026:04:07:58 +0200] "GET /config.php.bak HTTP/2.0" 403 106 "-" "Mozilla/5.0 (compatible; GoogleOther; +http://www.google.com/bot.html)" ... show less	Web App Attack
🇦🇺 2000cn.com.au	2026-07-23 02:05:48 (1 hour ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇺🇸 etu brutus	2026-07-23 01:29:35 (2 hours ago)	104.28.227.192 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
🇩🇪 Philister11	2026-07-23 00:36:08 (3 hours ago)	CrowdSec: crowdsecurity/http-sensitive-files (US/AS13335)	Web App Attack Hacking
🇩🇪 Marc	2026-07-22 23:17:56 (4 hours ago)	104.28.227.192 - - [23/Jul/2026:01:17:54 +0200] "GET /.git/HEAD HTTP/2.0" 404 269 "-" "Mozilla/5.0 ( ... show more 104.28.227.192 - - [23/Jul/2026:01:17:54 +0200] "GET /.git/HEAD HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)" 104.28.227.192 - - [23/Jul/2026:01:17:55 +0200] "GET /.git/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 104.28.227.192 - - [23/Jul/2026:01:17:55 +0200] "GET /.gitconfig HTTP/2.0" 404 269 "-" "Mozilla/5.0 (compatible; Diffbot/1.0; +https://diffbot.com)" show less	Brute-Force
🇮🇹 CoreTech srl	2026-07-22 23:13:56 (4 hours ago)	cloudlinux2 fail2ban: 2026-07-23 01:09:14,562 fail2ban.filter [1589]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-07-23 01:09:14,562 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 172.104.55.33 - 2026-07-23 01:09:14cloudlinux2 fail2ban: 2026-07-23 01:09:29,690 fail2ban.filter [1589]: INFO [plesk-wordpress] Found 188.213.202.78 - 2026-07-23 01:09:28cloudlinux2 fail2ban: 2026-07-23 01:10:50,488 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 104.28.227.192 - 2026-07-23 01:10:50cloudlinux2 fail2ban: 2026-07-23 01:10:51,474 fail2ban.actions [1589]: NOTICE [plesk-modsecurity] Ban 104.28.227.192cloudlinux2 fail2ban: 2026-07-23 01:10:51,481 fail2ban.filter [1589]: INFO [recidive] Found 104.28.227.192 - 2026-07-23 01:10:51cloudlinux2 fail2ban: 2026-07-23 01:10:51,283 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 104.28.227.192 - 2026-07-23 01:10:51cloudlinux2 fail2ban: 2026-07-23 01:10:51,294 fail2ban.filter [1589]: INFO [plesk-modsecurity] Found 104.28.227.192 - 2026-07-23 01:10:51cloudlinux2 fail2ban: 20 show less	Web App Attack
🇮🇹 mediarama.com	2026-07-22 23:09:52 (4 hours ago)	Banned by Fail2Ban	Web App Attack
🇵🇱 dzpk	2026-07-22 23:07:16 (4 hours ago)	[23/Jul/2026:01:07:15 +0200] 178476163597.517468 104.28.227.192 14603 HOST 443 [23/Jul/2026:01:07:15 ... show more [23/Jul/2026:01:07:15 +0200] 178476163597.517468 104.28.227.192 14603 HOST 443 [23/Jul/2026:01:07:15 +0200] 178476163543.014907 104.28.227.192 14603 HOST 443 [23/Jul/2026:01:07:15 +0200] 17847616359.973697 104.28.227.192 14603 HOST 443 show less	Web App Attack
🇿🇦 conure	2026-07-22 20:32:00 (7 hours ago)	csagent: score 20.0: secrets grab x2; 1 domain(s) in 0s	Web App Attack
Anonymous	2026-07-22 19:41:40 (8 hours ago)	(caddyscan) Scanner path probe from 104.28.227.192 (NO/Norway/-): 5 in the last 3600 secs; Ports: ; ... show more (caddyscan) Scanner path probe from 104.28.227.192 (NO/Norway/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 104.28.227.192 - - [22/Jul/2026:19:41:37 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 104.28.227.192 - - [22/Jul/2026:19:41:38 +0000] "GET /.aws/config HTTP/1.1" [REDACTED] 200 2627 104.28.227.192 - - [22/Jul/2026:19:41:39 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 104.28.227.192 - - [22/Jul/2026:19:41:39 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 104.28.227.192 - - [22/Jul/2026:19:41:39 +0000] "GET /.env.local HTTP/1.1" show less	Port Scan
🇨🇭 dalslab ltd	2026-07-22 19:17:26 (8 hours ago)	[22/Jul/2026:21:17:24 +0200] - 404 404 - GET https nc.dalslab.com "/service-account.json" [Client 10 ... show more [22/Jul/2026:21:17:24 +0200] - 404 404 - GET https nc.dalslab.com "/service-account.json" [Client 104.28.227.192] [Length 5055] [Gzip -] [Sent-to 10.1.1.253] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "-" [22/Jul/2026:21:17:24 +0200] - 404 404 - GET https nc.dalslab.com "/credentials.json" [Client 104.28.227.192] [Length 5055] [Gzip -] [Sent-to 10.1.1.253] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" "-" [22/Jul/2026:21:17:24 +0200] - 404 404 - GET https nc.dalslab.com "/.aws/config" [Client 104.28.227.192] [Length 5055] [Gzip -] [Sent-to 10.1.1.253] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "-" [22/Jul/2026:21:17:24 +0200] - 404 404 - GET https nc.dalslab.com "/config.json" [Client 104.28.227.192] [Length 5055] [Gzip -] [Sent-to 10.1.1.253] "Mozilla/5.0 (Macintosh; Intel ... show less	Web Spam Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 60 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.176.31.148

🇩🇪 69.5.169.17

🇭🇰 58.153.24.111

🇰🇷 211.252.94.26

🇳🇱 206.189.97.142

🇩🇪 185.242.3.175

🇳🇱 185.223.235.24

🇺🇸 184.105.247.194

🇺🇸 165.154.182.72

🇺🇸 146.88.241.87

🇺🇸 118.193.77.138

🇬🇧 94.198.81.4

🇺🇦 85.114.212.208

🇳🇱 81.19.216.68

🇧🇾 79.98.53.67

🇺🇸 64.62.156.226

🇧🇷 45.162.112.34

🇺🇸 205.210.31.66

🇰🇷 199.241.120.131

🇩🇪 194.88.98.117