JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.251.192

104.28.251.192 was found in our database!

This IP was reported 75 times. Confidence of Abuse is 49%: ?

49%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Kansas City, Missouri

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.251.192

Whois 104.28.251.192

IP Abuse Reports for 104.28.251.192:

This IP address has been reported a total of 75 times from 41 distinct sources. 104.28.251.192 was first reported on May 16th 2025, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Viveronese	2026-05-24 17:25:17 (2 weeks ago)	HTTP vulnerability scanning	Web App Attack
🇨🇭 Justin Case	2026-05-24 15:20:01 (2 weeks ago)	Automatically blocked by server	Fraud Orders
🇩🇪 4server	2026-05-24 09:21:57 (2 weeks ago)	[SunMay2411:21:53.6545842026][security2:error][pid2342451:tid2342574][client104.28.251.192:0]ModSecu ... show more [SunMay2411:21:53.6545842026][security2:error][pid2342451:tid2342574][client104.28.251.192:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mail.ksmstudio.ch\"][uri\"/.git/config\"][unique_id\"ahLDMYMjahPm2rAilIULRgAAAQ8\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 paissangroup	2026-05-23 21:08:40 (2 weeks ago)	Multiple WAF Violations	Web App Attack
🇨🇭 4server	2026-05-23 20:31:42 (2 weeks ago)	[SatMay2322:31:34.5695562026][security2:error][pid4021533:tid4021758][client104.28.251.192:0]ModSecu ... show more [SatMay2322:31:34.5695562026][security2:error][pid4021533:tid4021758][client104.28.251.192:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"foodelivery.benvenutialfood.ch\"][uri\"/.git/HEAD\"][unique_id\"ahIOpjwHio9ik2_LRktApAAAAQI\"] show less	Hacking Web App Attack
🇨🇭 ALPHANET	2026-05-23 17:47:54 (2 weeks ago)	web exploits	Hacking Exploited Host Web App Attack
🇨🇭 backslash	2026-05-23 11:27:02 (2 weeks ago)	block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1	Bad Web Bot
🇨🇭 Ribeye375	2026-05-23 11:12:54 (2 weeks ago)	HIPS apache-modsecurity - Block tcp/http,https	Web App Attack
🇩🇪 4server	2026-05-23 04:24:37 (2 weeks ago)	[SatMay2306:24:32.5701082026][security2:error][pid409070:tid409165][client104.28.251.192:0]ModSecuri ... show more [SatMay2306:24:32.5701082026][security2:error][pid409070:tid409165][client104.28.251.192:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"acquaallaspina.ch.bluwater.ch\"][uri\"/.env.development\"][unique_id\"ahEsAAIGyAQFwGc6WwUPiAAAAJM\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-05-22 14:05:07 (2 weeks ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇺🇸 TPI-Abuse	2026-05-22 13:13:49 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 09:13:46.064535 2026] [security2:error] [pid 28524:tid 28524] [client 104.28.251.192:39612] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "maps.marat.info"] [uri "/.git/HEAD"] [unique_id "ahBWitE9JYyJ8QGsOAFr4gAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-22 09:52:15 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 05:52:10.843163 2026] [security2:error] [pid 6818:tid 6818] [client 104.28.251.192:44395] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.amybeam.info"] [uri "/.git/HEAD"] [unique_id "ahAnSgOuFHFtyT_Y-m6tTQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-05-19 06:30:50 (3 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-05-18 16:02:00 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 12:01:56.738979 2026] [security2:error] [pid 30648:tid 30648] [client 104.28.251.192:41084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.citrineartstudio.com"] [uri "/.git/config"] [unique_id "ags39KTXoliUqO5F0ogX2gAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-18 15:34:24 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.251.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 11:34:17.632834 2026] [security2:error] [pid 19865:tid 19865] [client 104.28.251.192:39739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.illumoonatedtarot.com"] [uri "/.git/HEAD"] [unique_id "agsxeauDDQvk03WPwiUtfAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 75 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 66.132.186.208

🇱🇰 220.247.224.226

🇨🇳 219.159.57.4

🇧🇷 187.56.50.232

🇧🇷 179.51.153.37

🇺🇸 129.121.85.48

🇮🇳 128.185.226.54

🇹🇭 125.25.94.108

🇮🇩 111.95.184.83

🇩🇪 94.26.106.46

🇺🇸 66.132.195.28

🇱🇺 64.89.160.135

🇭🇰 38.76.163.44

🇬🇧 35.203.211.59

🇨🇦 24.207.66.154

🇩🇪 216.26.245.33

🇰🇷 211.223.107.86

🇨🇳 202.112.47.208

🇭🇰 182.239.82.88

🇺🇸 170.187.165.134