JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.252.27

Recent Activity

Abuse confidence score ?

43% Elevated

55 reports

33 reporters · latest 16 hours ago

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇵🇭 Philippines
City	Davao, Davao Region

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 104.28.252.27

Export CSV

This IP address has been reported a total of 55 times from 33 distinct sources. 104.28.252.27 was first reported on February 12th 2023, and the most recent report was 16 hours ago. In the last 60 days, the top reporter locations were: Italy with 3 reports; Australia with 2 reports; United States of America with 2 reports. The most common categories in these recent reports were: Brute-Force 5 times; Web App Attack 4 times; Bad Web Bot 2 times; Hacking 2 times; Email Spam 1 time; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 Olexiy Backend	2026-10-04 00:27:38 (16 hours ago)	104.28.252.27 ...	Bad Web Bot Web App Attack
🇺🇸 ricw	2026-10-01 01:41:51 (3 days ago)	[Phylax Security Report] Type: Web Exploit & Vulnerability Probe Source IP: 104.28.252.27 Endpoint: ... show more [Phylax Security Report] Type: Web Exploit & Vulnerability Probe Source IP: 104.28.252.27 Endpoint: POST /xmlrpc.php Timestamp: 1790818911353 ms Notes: Phylax autonomous decoy URI probe trapped on path '/xmlrpc.php' (Administrative & CMS Panel Probe) User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36 Forensic validation: Automated probe detected by deterministic application defense. show less	Hacking Web App Attack
🇦🇺 screwlooseit.com.au	2026-09-30 04:53:39 (4 days ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/-	Web App Attack
🇨🇿 lp	2026-09-24 12:20:14 (1 week ago)	Email account brute force: 1 attempts were recorded from 104.28.252.27 2026-09-24T13:28:01+02:00 war ... show more Email account brute force: 1 attempts were recorded from 104.28.252.27 2026-09-24T13:28:01+02:00 warning: unknown[104.28.252.27]: SASL PLAIN authentication failed: authentication failure, [email protected] show less	Brute-Force
Anonymous	2026-09-24 11:59:01 (1 week ago)	...	Brute-Force
🇮🇹 VHosting	2026-09-24 11:50:04 (1 week ago)	Detected mail brute force attack from different servers	Brute-Force
🇮🇹 Inartis	2026-09-24 05:31:06 (1 week ago)	104.28.252.27 - - [24/Sep/2026:07:31:05 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5210 "-" "Mozilla/5.0 ... show more 104.28.252.27 - - [24/Sep/2026:07:31:05 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5210 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-04 09:22:47 (1 month ago)	2026-09-04T19:22:46.240197+10:00 [X].[X].[X] postfix/smtpd[160054]: warning: unknown[104.28.252.27]: ... show more 2026-09-04T19:22:46.240197+10:00 [X].[X].[X] postfix/smtpd[160054]: warning: unknown[104.28.252.27]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=wim.beeckmans@[X].[X] show less	Email Spam Port Scan Hacking
🇮🇹 CoreTech srl	2026-08-30 06:17:32 (1 month ago)	"SMTP Login failed": count(IP)=30.0MX1-DC2 08:12:53.342 [220.235.145.228] SMTP Login failed: Domain ... show more "SMTP Login failed": count(IP)=30.0MX1-DC2 08:12:53.342 [220.235.145.228] SMTP Login failed: Domain [ideaformat.it] not foundMX1-DC2 08:12:53.342 [220.235.145.228] SMTP Login failed: Username or password is incorrect.is-6411d9d7 08:12:55.756 [104.28.252.27] SMTP Login failed: Invalid username ([email protected]) and password combination.is-6411d9d7 08:12:55.756 [104.28.252.27] SMTP Login failed: User [stlibbra] not foundMAIL4-new 08:13:01.072 [185.234.9.185] SMTP Login failed: Incorrect password for user [[email protected]]MAIL4-new 08:13:01.072 [185.234.9.185] SMTP Login failed: Invalid username ([email protected]) and password combination.is-6411d9d7 08:14:03.663 [185.234.9.185] SMTP Login failed: Incorrect password for user [[email protected]]is-6411d9d7 08:14:03.663 [185.234.9.185] SMTP Login failed: Invalid username ([email protected]) and password combination.mail3-dc1 08:14:14.297 [185.234.9.185] SMTP Login failed: Incorrect password for user [[email protected]] show less	Brute-Force
🇳🇿 Antinson	2026-02-22 14:58:45 (7 months ago)	Scraping with a high error ratio and request rate	Bad Web Bot
🇬🇧 Artelis	2025-10-04 10:10:06 (1 year ago)	104.28.252.27 - - [04/Oct/2025:10:10:03 +0000] "GET /.env HTTP/1.1" 404 1803 "-" "Mozilla/5.0 (Windo ... show more 104.28.252.27 - - [04/Oct/2025:10:10:03 +0000] "GET /.env HTTP/1.1" 404 1803 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0" 104.28.252.27 - - [04/Oct/2025:10:10:03 +0000] "GET /.env.prod HTTP/1.1" 404 1807 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0" 104.28.252.27 - - [04/Oct/2025:10:10:03 +0000] "GET /.env.new HTTP/1.1" 404 1806 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:121.0) Gecko/20100101 Firefox/121.0" 104.28.252.27 - - [04/Oct/2025:10:10:04 +0000] "GET /.env.old HTTP/1.1" 404 1805 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 104.28.252.27 - - [04/Oct/2025:10:10:04 +0000] "GET /.env-prod HTTP/1.1" 404 1803 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" 104.28.252.27 - - [04/Oct/2025:10:10: ... show less	Web App Attack
Anonymous	2025-10-04 05:22:18 (1 year ago)	Ports: *; Direction: 0; Trigger: CT_LIMIT	Brute-Force SSH
Anonymous	2025-10-04 04:41:08 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-09-08 11:46:42 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 104.28.252.27 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 104.28.252.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 07:46:35.191222 2025] [security2:error] [pid 27125:tid 27125] [client 104.28.252.27:38919] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hl-re.com"] [uri "/core/.git/config"] [unique_id "aL7CG6abGIldLfaHWX6cTwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2025-09-05 08:37:15 (1 year ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 104.28.252.27 (PH/Philippines/-): 1 ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 104.28.252.27 (PH/Philippines/-): 1 in the last 3600 secs show less	Web App Attack

Showing 1 to 15 of 55 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.130.21.51

🇺🇸 143.42.0.97

🇺🇸 108.178.7.34

🇭🇰 104.208.92.45

🇵🇱 91.206.26.26

🇺🇿 213.230.93.14

🇩🇪 213.209.159.108

🇭🇰 199.45.155.59

🇧🇷 190.89.55.250

🇧🇷 187.33.218.139

🇨🇴 186.0.5.173

🇸🇬 178.128.26.245

🇳🇱 159.65.205.128

🇮🇳 157.119.202.69

🇺🇸 108.175.164.22

🇺🇸 108.175.0.166

🇨🇴 108.174.156.122

🇧🇷 108.174.147.120

🇮🇷 93.114.107.65

🇺🇸 74.207.253.22