104.28.247.164

Recent Activity This IP has received recent abuse reports, which causes the score to increase.
Abuse Confidence Score
40% Elevated
26 reports
13 reporters · latest 46 minutes ago
ISP
Cloudflare, Inc.
Usage Type
Data Center/Web Hosting/Transit
ASN
AS13335
Domain Name
cloudflare.com
Country
🇺🇸 United States of America
City
Fremont, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois
Log in to view charts and search reports for this IP. Log In
Example preview
Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV
Total reports
26 from 13 distinct reporters
First reported
Most recent report
Last 60 days
Top reporter locations 🇩🇪 Germany 11 🇦🇺 Australia 1 🇧🇷 Brazil 1
Most common categories Web App Attack 14 Hacking 8 Brute-Force 3 Port Scan 1 SQL Injection 1
Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.
Log in to search reports. Log In
Reporter IoA Timestamp (UTC) Comment Categories
🇩🇪 throny
Hacking Web App Attack
🇩🇪 throny
Web App Attack
🇩🇪 throny
Web App Attack
🇧🇷 ICS Labs
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-11 UTC.
Brute-Force
🇩🇪 ghostwarriors
Attempts against non-existent wp-login
Brute-Force Web App Attack
🇩🇪 throny
Web App Attack
🇩🇪 throny
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-11 02:01 UTC, API call GetCallerIdentity, client python-requests/2.34.2
Hacking Web App Attack
🇺🇸 HamSammich
Automated sensor: 2 HTTPS connection/probe attempts over the last 24h (latest 2026-11-10T03:39Z).
Port Scan Web App Attack
🇩🇪 throny
Hacking Web App Attack
🇩🇪 throny
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-09 06:06 UTC, API call GetCallerIdentity, client python-requests/2.34.2
Hacking Web App Attack
🇩🇪 throny
Hacking Web App Attack
🇩🇪 throny
Hacking Web App Attack
🇩🇪 throny
Used an AWS access key that exists only in a honeypot's fake config file (canary token) at 2026-11-07 14:13 UTC, API call GetUser, client python-requests/2.34.2
Hacking Web App Attack
Anonymous
Malicious activity detected
Hacking Web App Attack
🇮🇩 PENJAGA.AUM
104.28.247.164 - Attack: Possible XSS attack, js event handler
Web App Attack SQL Injection Spoofing

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 202.110.74.30
🇺🇸 184.105.247.235
🇮🇳 162.4.81.4
🇹🇼 122.117.141.59
🇵🇱 2400:cb00:73:1000:d19e:26c2:90f1:7cec
🇵🇱 2400:cb00:73:1000:1b92:d54a:4a00:eb1e
🇨🇦 209.239.6.139
🇮🇶 169.224.100.167
🇫🇮 147.185.133.62
🇮🇳 122.187.221.130
🇨🇳 122.114.255.230
🇳🇱 109.160.32.171
🇺🇸 47.89.129.126
🇦🇷 2802:8010:322b:501:40fc:be57:29e3:a1d3
🇨🇦 108.160.90.213
🇵🇹 95.93.91.44
🇷🇴 80.94.92.179
🇺🇸 71.6.155.70
🇺🇸 45.79.181.251
🇮🇳 27.58.141.195
feedback