JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.243.191

Neutral Activity

Abuse Confidence Score

0% Low Risk

46 reports

26 reporters · latest 2 months ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇫🇷 France
City: Paris, Ile-de-France

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

104.28.243.191 has been reported 46 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

46 from 26 distinct reporters

First reported

February 11th 2024

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-31 22:46:17 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 18:46:13.072946 2026] [security2:error] [pid 4938:tid 4938] [client 104.28.243.191:46943] M ... show more (mod_security) mod_security (id:210492) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 18:46:13.072946 2026] [security2:error] [pid 4938:tid 4938] [client 104.28.243.191:46943] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aldrich.us"] [uri "/config/.env.php"] [unique_id "apYENdzWxYSnkGTwp1KunwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Smish	2026-08-14 21:24:36 UTC · (2 months ago)	HONEYPOT HIT --> Fail2ban time=1786742675 log=2026-08-14T22:24:35+01:00 ip=104.28.243.191 host=test.smishcraft.com method=GET uri="/.aws/config" status=404 ua="Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" ... show more HONEYPOT HIT --> Fail2ban time=1786742675 log=2026-08-14T22:24:35+01:00 ip=104.28.243.191 host=test.smishcraft.com method=GET uri="/.aws/config" status=404 ua="Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" ref="-" rid=c5c6e580fb5388965026b682b3872e76 show less	Web App Attack
🇺🇸 Lee Daniel	2026-08-14 20:41:21 UTC · (2 months ago)	104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /secrets.yml HTTP/1.1" 404 27521 "-" "Mozilla/5.0 (compatible; GoogleOther; +http://www.google.com/bot.html)" 104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /secrets.json HTTP/1.1" 404 27524 ... show more 104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /secrets.yml HTTP/1.1" 404 27521 "-" "Mozilla/5.0 (compatible; GoogleOther; +http://www.google.com/bot.html)" 104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /secrets.json HTTP/1.1" 404 27524 "-" "Mozilla/5.0 (compatible; GoogleOther; +http://www.google.com/bot.html)" 104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /dist/manifest.json HTTP/1.1" 404 26629 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0" 104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /static/manifest.json HTTP/1.1" 404 26635 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0" 104.28.243.191 - - [14/Aug/2026:16:41:20 -0400] "GET /asset-manifest.json HTTP/1.1" 404 26621 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152 ... show less	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
🇿🇦 conure.sh	2026-08-14 09:58:18 UTC · (2 months ago)	csagent: score 21.8: 404 noise floor x7, secrets grab x2; 1 domain(s) in 0s	Web App Attack
🇺🇸 TPI-Abuse	2026-08-14 03:57:05 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 23:57:01.601731 2026] [security2:error] [pid 25703:tid 25703] [client 104.28.243.191:46753] ... show more (mod_security) mod_security (id:210492) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 23:57:01.601731 2026] [security2:error] [pid 25703:tid 25703] [client 104.28.243.191:46753] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "simtimxr.com"] [uri "/web.config"] [unique_id "an6SDVfxIMjxkUW3D39VlAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Smish	2026-08-14 02:49:56 UTC · (2 months ago)	HONEYPOT HIT --> Fail2ban time=1786675794 log=2026-08-14T03:49:54+01:00 ip=104.28.243.191 host=client.smishcraft.com method=GET uri="/.aws/config" status=404 ua="Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) ... show more HONEYPOT HIT --> Fail2ban time=1786675794 log=2026-08-14T03:49:54+01:00 ip=104.28.243.191 host=client.smishcraft.com method=GET uri="/.aws/config" status=404 ua="Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" ref="-" rid=0f7b89a2e34fbb4cae78b827105ff30d show less	Web App Attack
🇩🇪 Marc	2026-08-14 02:22:21 UTC · (2 months ago)	104.28.243.191 - - [14/Aug/2026:04:22:20 +0200] "GET /.git/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 104.28.243.191 - - [14/Aug/2026:04:22:21 +0200] "GET / ... show more 104.28.243.191 - - [14/Aug/2026:04:22:20 +0200] "GET /.git/config HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 104.28.243.191 - - [14/Aug/2026:04:22:21 +0200] "GET /.git-credentials HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 104.28.243.191 - - [14/Aug/2026:04:22:21 +0200] "GET /.git/HEAD HTTP/2.0" 404 269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" show less	Brute-Force
🇳🇱 e.fierstra	2026-08-14 01:17:57 UTC · (2 months ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-14 01:09:26 UTC · (2 months ago)	(mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 21:09:23.039048 2026] [security2:error] [pid 3511666:tid 3511666] [client 104.28.243.191:14 ... show more (mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 21:09:23.039048 2026] [security2:error] [pid 3511666:tid 3511666] [client 104.28.243.191:14555] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|rocketfuelpartners.com\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rocketfuelpartners.com"] [uri "/rclone.conf"] [unique_id "an5qwygHDbHfz4BtdUM3ggAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-13 23:19:05 UTC · (2 months ago)	(mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 19:19:01.560843 2026] [security2:error] [pid 3380923:tid 3380923] [client 104.28.243.191:19 ... show more (mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 19:19:01.560843 2026] [security2:error] [pid 3380923:tid 3380923] [client 104.28.243.191:19943] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|teamconnell.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "teamconnell.com"] [uri "/z9x8c7v6b5-debug-trigger-teamconnell.com"] [unique_id "an5Q5TuR-1-xg5Gwed0MoQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-08-13 22:40:01 UTC · (2 months ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-13 22:08:25 UTC · (2 months ago)	(mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 18:08:17.638869 2026] [security2:error] [pid 30552:tid 30552] [client 104.28.243.191:44406] ... show more (mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 18:08:17.638869 2026] [security2:error] [pid 30552:tid 30552] [client 104.28.243.191:44406] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|underraided.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "underraided.com"] [uri "/z9x8c7v6b5-debug-trigger-underraided.com"] [unique_id "an5AUUsrBEDx-yxclt2miwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 YF	2026-08-13 20:30:17 UTC · (2 months ago)	404 errors Vulnerability scan	Web App Attack
🇺🇸 TPI-Abuse	2026-08-13 20:28:11 UTC · (2 months ago)	(mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 16:28:07.714308 2026] [security2:error] [pid 11054:tid 11054] [client 104.28.243.191:17024] ... show more (mod_security) mod_security (id:210730) triggered by 104.28.243.191 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 16:28:07.714308 2026] [security2:error] [pid 11054:tid 11054] [client 104.28.243.191:17024] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|tradesecretintrust.com\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tradesecretintrust.com"] [uri "/rclone.conf"] [unique_id "an4o1yBpC7wCzK0MCEBoOQAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Smish	2026-08-13 18:10:10 UTC · (2 months ago)	HONEYPOT HIT --> Fail2ban time=1786644608 log=2026-08-13T19:10:08+01:00 ip=104.28.243.191 host=clients.smishcraft.com method=GET uri="/wp-config.php.bak" status=404 ua="Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/ama ... show more HONEYPOT HIT --> Fail2ban time=1786644608 log=2026-08-13T19:10:08+01:00 ip=104.28.243.191 host=clients.smishcraft.com method=GET uri="/wp-config.php.bak" status=404 ua="Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" ref="-" rid=3e21b04d8cb45940368abe80b3778f50 show less	Web App Attack

Showing 1 to 15 of 46 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 162.216.150.211

🇺🇸 24.246.185.215

🇷🇺 2a00:1248:5001:3::f:1

🇲🇽 187.169.82.43

🇮🇳 182.76.115.214

🇧🇩 165.101.132.248

🇺🇸 146.190.216.108

🇨🇳 115.191.40.50

🇻🇳 115.77.255.30

🇮🇩 103.183.22.74

🇺🇸 91.230.168.231

🇺🇸 91.230.168.100

🇳🇱 77.239.124.66

🇺🇸 74.119.52.61

🇳🇱 45.74.28.203

🇺🇸 173.46.92.53

🇭🇰 152.32.254.132

🇨🇳 116.52.252.150

🇳🇱 77.239.124.155

🇺🇸 66.132.186.128