JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.254.134

104.28.254.134 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 30%: ?

30%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇧🇷 Brazil
City	Florianopolis, Santa Catarina

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.254.134

Whois 104.28.254.134

IP Abuse Reports for 104.28.254.134:

This IP address has been reported a total of 28 times from 17 distinct sources. 104.28.254.134 was first reported on July 22nd 2023, and the most recent report was 44 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-22 16:33:12 (44 minutes ago)	(mod_security) mod_security (id:210492) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 12:32:59.041239 2026] [security2:error] [pid 530900:tid 530996] [client 104.28.254.134:52039] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "soluciona.biz"] [uri "/.env.save"] [unique_id "amDwu0COxCl0BIpc-ue3NAAAAJQ"], referer: https://www.google.com/search?q=soluciona.biz show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Al Coholic	2026-07-22 15:51:25 (1 hour ago)	Detected By Fail2ban	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 14:22:10 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 10:21:59.995535 2026] [security2:error] [pid 2226406:tid 2226406] [client 104.28.254.134:30112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sublimationconsultants.ipostsocialmedia.com"] [uri "/.env.backup"] [unique_id "amDSB0ccBK4HqrtD6jwUtgAAABY"], referer: https://www.google.com/search?q=www.sublimationconsultants.ipostsocialmedia.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 13:57:28 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 09:57:21.852322 2026] [security2:error] [pid 894899:tid 894899] [client 104.28.254.134:63305] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "reettaanttila.com"] [uri "/.env.production"] [unique_id "amDMQVrA-XE92bu52Stu2gAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-22 13:39:29 (3 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-197)	Hacking Web App Attack
🇺🇸 kosada.com	2026-07-06 15:55:07 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇧🇷 chronos	2026-02-07 00:47:19 (5 months ago)	Generic malicious activity detected: Tentativa de varredura de porta TCP... \| Proto: TCP \| Port: 596 ... show more Generic malicious activity detected: Tentativa de varredura de porta TCP... \| Proto: TCP \| Port: 59601 \| Location: Brazil, Florianópolis show less	Port Scan Hacking
🇧🇷 chronos	2026-02-02 23:06:00 (5 months ago)	Generic malicious activity detected: Tentativa de varredura de porta TCP... \| Proto: TCP \| Port: 596 ... show more Generic malicious activity detected: Tentativa de varredura de porta TCP... \| Proto: TCP \| Port: 59601 \| Location: Brazil, Florianópolis show less	Port Scan Hacking
🇧🇾 lns.bz	2025-12-27 21:05:24 (6 months ago)	Banned for trying to access xmlrpc [BY]	Web App Attack
Anonymous	2025-11-20 17:04:18 (8 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-11-17 04:53:51 (8 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-10-19 21:30:18 (9 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇺🇸 TPI-Abuse	2025-10-14 14:16:00 (9 months ago)	(mod_security) mod_security (id:210730) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 104.28.254.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 10:15:53.710978 2025] [security2:error] [pid 475:tid 475] [client 104.28.254.134:9345] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cnprcertificationreviews.org\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cnprcertificationreviews.org"] [uri "/instagram.com"] [unique_id "aO5bGQwEV9W0RiWsvx_JhAAAACs"], referer: https://cnprcertificationreviews.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 exxos	2025-09-24 19:03:01 (9 months ago)	Attacks with Bad user agents	Hacking
🇳🇱 exxos	2025-08-01 03:44:01 (11 months ago)	http-no-verb	Hacking

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 91.231.89.82

🇺🇸 71.230.72.124

🇯🇵 43.165.170.19

🇲🇽 187.154.144.166

🇳🇱 185.242.226.66

🇨🇳 171.104.143.176

🇨🇳 123.58.249.106

🇨🇦 104.207.48.39

🇷🇴 92.118.39.50

🇫🇷 91.167.56.247

🇰🇷 61.32.68.66

🇧🇷 45.238.201.193

🇧🇷 45.188.169.6

🇺🇸 34.197.70.90

🇺🇸 20.119.86.70

🇻🇳 1.52.240.18

🇰🇷 211.223.107.86

🇺🇸 195.184.76.210

🇹🇷 131.222.246.168

🇺🇸 81.30.98.204