JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.247.122

Recent Activity

Abuse Confidence Score

32% Elevated

106 reports

51 reporters · latest 2 days ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇮🇶 Iraq
City: Baghdad, Baghdad

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

106 from 51 distinct reporters

First reported

September 4th 2023

Most recent report

2 days ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 10 🇫🇷 France 2 🇩🇪 Germany 1

Most common categories Brute-Force 10 SSH 9 Web App Attack 7 Hacking 6 Bad Web Bot 3

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 justbible	2026-11-10 21:42:22 UTC · (2 days ago)	HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 4 requests from 2026-11-10T21:42:22+00:00 to 2026-11-11T03:24:30+00:00, e.g. 'GET /en/darby,ylt/preferences?from=%2Fen%2Fdarby%2Cylt%2Fnum%2F23%2F8 HTTP/2.0' with User-Agent ... show more HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 4 requests from 2026-11-10T21:42:22+00:00 to 2026-11-11T03:24:30+00:00, e.g. 'GET /en/darby,ylt/preferences?from=%2Fen%2Fdarby%2Cylt%2Fnum%2F23%2F8 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested). show less	Bad Web Bot
🇩🇪 LRob	2026-11-09 09:07:10 UTC · (3 days ago)	Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader \| path: /Shieldlist/shieldlist-controller/raw/commit/6ef31d747ca65903c6c7bdb84774f9abba5147c0/internal/config/own_path_test.go \| src_port: 12780 \| ua: Mozilla/5.0 (Mac ... show more Proxynvader botnet, code forge crawl: https://shieldlist.eu/en/threats/proxynvader \| path: /Shieldlist/shieldlist-controller/raw/commit/6ef31d747ca65903c6c7bdb84774f9abba5147c0/internal/config/own_path_test.go \| src_port: 12780 \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 show less	DDoS Attack Bad Web Bot
🇺🇸 lostswordfish.com	2026-11-05 20:08:04 UTC · (1 week ago)	Wordfence waf block on parsol	Web App Attack
🇺🇸 p0tatosmash3r	2026-10-15 19:27:48 UTC · (4 weeks ago)	Honeypot-observed (last seen 2026-10-15 19:27 UTC): 3038 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2> ... show more Honeypot-observed (last seen 2026-10-15 19:27 UTC): 3038 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| wget -q -O /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| …. show less	Brute-Force SSH Hacking Web App Attack
🇺🇸 p0tatosmash3r	2026-10-15 03:29:06 UTC · (4 weeks ago)	Honeypot-observed (last seen 2026-10-15 03:29 UTC): 2822 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2> ... show more Honeypot-observed (last seen 2026-10-15 03:29 UTC): 2822 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| wget -q -O /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| …. show less	Brute-Force SSH Hacking Web App Attack
🇺🇸 p0tatosmash3r	2026-10-14 00:57:18 UTC · (4 weeks ago)	Honeypot-observed (last seen 2026-10-14 00:57 UTC): 2571 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2> ... show more Honeypot-observed (last seen 2026-10-14 00:57 UTC): 2571 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| wget -q -O /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| …. show less	Brute-Force SSH Hacking Web App Attack
🇺🇸 p0tatosmash3r	2026-10-13 01:00:25 UTC · (1 month ago)	Honeypot-observed (last seen 2026-10-13 01:00 UTC): 2395 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2> ... show more Honeypot-observed (last seen 2026-10-13 01:00 UTC): 2395 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| wget -q -O /dev/null 'https://ammaralhakeem.com/' 2>/dev/null \|\| …. show less	Brute-Force SSH Hacking Web App Attack
Anonymous	2026-10-12 06:47:32 UTC · (1 month ago)	$f2bV_matches	Brute-Force SSH
🇺🇸 p0tatosmash3r	2026-10-12 00:54:47 UTC · (1 month ago)	Honeypot-observed (last seen 2026-10-12 00:54 UTC): 2162 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://www.icts.gov.iq/' 2>/d ... show more Honeypot-observed (last seen 2026-10-12 00:54 UTC): 2162 SSH/Telnet login attempt(s); post-auth shell commands; command/shell injection attempt. Evidence: creds root:linux, admin:admin \| cmd expr $i - 1 \| inj /dev/null 'https://www.icts.gov.iq/' 2>/dev/null \|\| wget -q -O /dev/null 'https://www.icts.gov.iq/' 2>/dev/null \|\| curl…. show less	Brute-Force SSH Hacking Web App Attack
🇺🇸 p0tatosmash3r	2026-10-10 16:17:48 UTC · (1 month ago)	Honeypot-observed malicious activity: 2040 SSH/Telnet login attempts; post-auth shell commands; command/shell injection attempt.	Brute-Force SSH Hacking Web App Attack
🇮🇹 VHosting	2026-10-09 10:15:04 UTC · (1 month ago)	Detected mail brute force attack from different servers	Brute-Force
Anonymous	2026-09-26 07:34:29 UTC · (1 month ago)	$f2bV_matches	Brute-Force SSH
🇫🇷 ACE-INFORMATIQUE.NC	2026-09-19 19:00:35 UTC · (1 month ago)	Brute-Force + SSH (honeypot) blocked by Fail2ban	Brute-Force SSH
Anonymous	2026-09-19 09:54:46 UTC · (1 month ago)	[Sat Sep 19 12:54:43.090580 2026] [cgi:error] [pid 20374] [client 104.28.247.122:46919] script not found or unable to stat: /var/www/cgi-bin/luci [Sat Sep 19 12:54:45.602467 2026] [cgi:error] [pid 8359] [client 104.28.247.122:13912] script not found ... show more [Sat Sep 19 12:54:43.090580 2026] [cgi:error] [pid 20374] [client 104.28.247.122:46919] script not found or unable to stat: /var/www/cgi-bin/luci [Sat Sep 19 12:54:45.602467 2026] [cgi:error] [pid 8359] [client 104.28.247.122:13912] script not found or unable to stat: /var/www/cgi-bin/luci show less	Bad Web Bot
Anonymous	2026-09-10 09:57:24 UTC · (2 months ago)	$f2bV_matches	Brute-Force SSH

Showing 1 to 15 of 106 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 213.209.159.242

🇺🇦 185.101.218.65

🇹🇼 162.158.243.149

🇳🇱 160.119.76.173

🇺🇸 129.121.136.201

🇸🇬 103.189.234.27

🇵🇱 2400:cb00:73:1000:ca5e:9bf9:5b91:3009

🇮🇳 223.233.71.117

🇭🇰 202.146.223.164

🇧🇪 198.235.24.185

🇧🇴 181.114.163.99

🇺🇸 165.227.84.134

🇩🇪 151.243.11.172

🇩🇪 139.162.134.190

🇨🇳 122.228.141.226

🇧🇩 103.127.1.122

🇫🇷 88.176.146.154

🇫🇮 80.223.190.179

🇺🇸 71.90.30.53

🇳🇱 45.148.10.151