JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 116.204.104.27

116.204.104.27 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 55%: ?

55%

ISP	Huawei Public Cloud Service (Huawei Software Technologies Ltd.Co)
Usage Type	Data Center/Web Hosting/Transit
ASN	AS55990
Hostname(s)	ecs-116-204-104-27.compute.hwclouds-dns.com
Domain Name	huawei.com
Country	🇨🇳 China
City	Beijing, Beijing

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 116.204.104.27

Whois 116.204.104.27

IP Abuse Reports for 116.204.104.27:

This IP address has been reported a total of 38 times from 28 distinct sources. 116.204.104.27 was first reported on April 4th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 backslash	2026-07-10 19:51:01 (6 hours ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot
🇺🇸 jcbriar	2026-07-03 22:14:05 (1 week ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇩🇪 HandyTreff.de	2026-06-28 15:45:11 (1 week ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -93.552 (Bad < -10 / Very Bad < -20 ... show more Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -93.552 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0. show less	Web App Attack Bad Web Bot
🇺🇸 kosada.com	2026-06-26 12:54:33 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇦🇺 paulshipley.com.au	2026-06-23 10:09:09 (2 weeks ago)	talentaymerch.com.au:443 116.204.104.27 - - [23/Jun/2026:20:09:01 +1000] "GET /ip HTTP/1.1" 404 1143 ... show more talentaymerch.com.au:443 116.204.104.27 - - [23/Jun/2026:20:09:01 +1000] "GET /ip HTTP/1.1" 404 114370 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" ... show less	Web App Attack
🇦🇺 paulshipley.com.au	2026-06-22 22:15:17 (2 weeks ago)	stkildashule.org.au:443 116.204.104.27 - - [23/Jun/2026:08:15:07 +1000] "GET /ip HTTP/1.1" 404 49598 ... show more stkildashule.org.au:443 116.204.104.27 - - [23/Jun/2026:08:15:07 +1000] "GET /ip HTTP/1.1" 404 49598 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-06-21 18:09:51 (2 weeks ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Excessive filters used: /brands/kramer/amplifiers/shopby/manufacturer-kramer.html?SID=4a4ec38ff2032d0505b232d203765b12&dir=asc&mode=list&order=most_viewed&p=4&rating=6&stock=1 \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 \| (Magento Site) show less	Hacking Bad Web Bot
🇦🇺 afleventoffice.com.au	2026-06-21 00:21:09 (2 weeks ago)	GET /ip HTTP/1.1	Web App Attack
🇬🇷 setupgr	2026-06-10 19:58:38 (1 month ago)	(mod_security) mod_security (id:100011) triggered by 116.204.104.27: 1 in the last 86400 secs; Ports ... show more (mod_security) mod_security (id:100011) triggered by 116.204.104.27: 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Jun 10 22:58:28.691025 2026] [security2:error] [pid 1859163:tid 1859181] [remote 116.204.104.27:53324] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(www\\\\.)?ftiaxtomonosou\\\\.gr" at SERVER_NAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "54"] [id "100011"] [msg "CSF-TRIGGER: Country Block CN/SG for ftiaxtomonosou.gr"] [hostname "www.ftiaxtomonosou.gr"] [uri "/tag/pellets/"] [unique_id "ainB5EcRGABfnax9yYgFBAAACA4"] show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-08 13:16:27 (1 month ago)	(mod_security) mod_security (id:210381) triggered by 116.204.104.27 (ecs-116-204-104-27.compute.hwcl ... show more (mod_security) mod_security (id:210381) triggered by 116.204.104.27 (ecs-116-204-104-27.compute.hwclouds-dns.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 09:16:24.225082 2026] [security2:error] [pid 7850:tid 7870] [client 116.204.104.27:50264] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt\|\|www.mentzlaw.com\|F\|4"] [data "REQUEST_URI=/lawyerliabilitylouisianaproduct/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mentzlaw.com"] [uri "/lawyerliabilitylouisianaproduct/%url%"] [unique_id "aibAqJP3GlukBrpXvDaByAAAAcw"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 1gz	2026-06-08 07:22:34 (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET m ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /ip UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇵🇱 sefinek.net	2026-06-03 22:06:42 (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (G ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (GET) \| Endpoint: /ip \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 JuicyJ	2026-06-02 11:29:38 (1 month ago)	Trying to look for places to exploit	Web Spam
🇺🇸 BSG Webmaster	2026-05-25 02:18:53 (1 month ago)	Hacking Attempt using path /ip	Hacking
🇷🇺 Mga Admin	2026-05-24 15:28:00 (1 month ago)	116.204.104.27 - - [24/May/2026:22:27:59 +0700] "GET /ip HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macinto ... show more 116.204.104.27 - - [24/May/2026:22:27:59 +0700] "GET /ip HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 185.169.4.12

🇺🇸 162.216.150.164

🇹🇼 104.199.176.250

🇺🇸 65.49.20.73

🇵🇪 38.250.187.139

🇺🇸 2607:f8b0:4001:c70::128

🇺🇸 185.198.240.54

🇧🇴 181.114.93.153

🇺🇸 173.255.221.189

🇧🇴 166.114.133.211

🇺🇸 162.216.149.62

🇪🇨 157.100.107.134

🇺🇸 147.185.132.215

🇨🇱 136.248.247.188

🇵🇱 94.26.88.19

🇬🇧 89.37.172.134

🇨🇦 85.217.149.64

🇰🇷 59.24.133.197

🇬🇧 51.195.183.252

🇬🇧 35.203.210.54