JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.152.239

104.28.152.239 was found in our database!

This IP was reported 66 times. Confidence of Abuse is 98%: ?

98%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Bountiful, Utah

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.152.239

Whois 104.28.152.239

IP Abuse Reports for 104.28.152.239:

This IP address has been reported a total of 66 times from 41 distinct sources. 104.28.152.239 was first reported on December 4th 2024, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Paul Smith	2026-06-14 19:23:16 (11 hours ago)	Email Auth Brute force attack 6/1 in last day	Brute-Force
🇬🇧 Hobby Bob	2026-06-14 17:33:02 (13 hours ago)	Jun 14 18:33:02 mail postfix/submission/smtpd[1838356]: warning: unknown[104.28.152.239]: SASL PLAIN ... show more Jun 14 18:33:02 mail postfix/submission/smtpd[1838356]: warning: unknown[104.28.152.239]: SASL PLAIN authentication failed: show less	Hacking Brute-Force
🇧🇷 SvrAdmin	2026-06-14 15:40:02 (15 hours ago)	[101] (smtpauth) Failed SMTP AUTH login from 104.28.152.239 (CA/Canada/-): 5 in the last 3600 secs; ... show more [101] (smtpauth) Failed SMTP AUTH login from 104.28.152.239 (CA/Canada/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-06-14 11:44:05 dovecot_login authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:34016: 535 Incorrect authentication data ([email protected]) 2026-06-14 11:46:31 dovecot_plain authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:38286: 535 Incorrect authentication data ([email protected]) 2026-06-14 11:46:37 dovecot_login authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:38286: 535 Incorrect authentication data ([email protected]) 2026-06-14 12:39:50 dovecot_plain authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:39232: 535 Incorrect authentication data ([email protected]) 2026-06-14 12:39:56 dovecot_login authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:39232: 535 Incorrect authentication data ([email protected]) show less	Port Scan Hacking Brute-Force Exploited Host
🇧🇷 SvrAdmin	2026-06-14 14:44:04 (16 hours ago)	[101] (smtpauth) Failed SMTP AUTH login from 104.28.152.239 (CA/Canada/-): 5 in the last 3600 secs; ... show more [101] (smtpauth) Failed SMTP AUTH login from 104.28.152.239 (CA/Canada/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-06-14 11:42:09 dovecot_plain authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:61220: 535 Incorrect authentication data ([email protected]) 2026-06-14 11:42:15 dovecot_login authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:61220: 535 Incorrect authentication data ([email protected]) 2026-06-14 11:43:47 dovecot_plain authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:54097: 535 Incorrect authentication data ([email protected]) 2026-06-14 11:43:53 dovecot_login authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:54097: 535 Incorrect authentication data ([email protected]) 2026-06-14 11:44:02 dovecot_plain authenticator failed for H=(mail.areyou.com.br) [104.28.152.239]:34016: 535 Incorrect authentication data ([email protected]) show less	Port Scan Hacking Brute-Force Exploited Host
🇷🇴 iulianh	2026-06-14 14:22:41 (16 hours ago)	25,465,587	Brute-Force SSH
🇩🇪 mondor.ro	2026-06-13 22:05:26 (1 day ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 104.28.152.239, Reason ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 104.28.152.239, Reason:[(smtpauth) Failed SMTP AUTH login from 104.28.152.239 (US/United States/-): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇩🇪 vcis.de	2026-06-13 20:47:57 (1 day ago)	SMTP brute force attack detected from [104.28.152.239]	Brute-Force
🇩🇪 Paul Smith	2026-06-13 19:20:03 (1 day ago)	Email Auth Brute force attack 2/1 in last day	Brute-Force
🇨🇦 electronico	2026-06-13 17:25:37 (1 day ago)	2026-06-14T04:23:47.035507+11:00 mail postfix/smtps/smtpd[1063226]: warning: unknown[104.28.152.239] ... show more 2026-06-14T04:23:47.035507+11:00 mail postfix/smtps/smtpd[1063226]: warning: unknown[104.28.152.239]: SASL PLAIN authentication failed: (reason unavailable), [email protected] 2026-06-14T04:23:53.252614+11:00 mail postfix/smtps/smtpd[1063226]: warning: unknown[104.28.152.239]: SASL LOGIN authentication failed: (reason unavailable), [email protected] 2026-06-14T04:25:37.015318+11:00 mail postfix/smtps/smtpd[1063748]: warning: unknown[104.28.152.239]: SASL PLAIN authentication failed: (reason unavailable), [email protected] ... show less	Brute-Force Email Spam
🇧🇷 hostseries	2026-06-13 17:22:44 (1 day ago)	Trigger: LF_SMTPAUTH	Brute-Force
🇩🇪 NewGastroline	2026-06-13 14:16:11 (1 day ago)	Malicious request blocked by CrowdSec on gastro-prod1.boreus.de	Bad Web Bot Web App Attack
🇫🇷 tecnicorioja	2026-06-13 14:00:40 (1 day ago)	SASL LOGIN authentication failed Jun 13 14:36:41	Brute-Force
🇨🇭 Origon	2026-06-13 13:02:11 (1 day ago)	postfix-non-smtp-command - IP: 104.28.152.239 - time="2026-06-13T15:02:10+02:00" level=info msg="(5 ... show more postfix-non-smtp-command - IP: 104.28.152.239 - time="2026-06-13T15:02:10+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-non-smtp-command by ip 104.28.152.239 (US/13335) : 4h ban on Ip 104.28.152.239" module=db show less	Email Spam
🇮🇩 Burayot	2026-06-13 12:37:46 (1 day ago)	LF_EXIMSYNTAX: (eximsyntax) Exim syntax errors from 104.28.152.239 (US/United States/-): 1 in the la ... show more LF_EXIMSYNTAX: (eximsyntax) Exim syntax errors from 104.28.152.239 (US/United States/-): 1 in the last 3600 secs show less	Brute-Force
🇫🇷 adlp.org	2026-06-13 12:37:36 (1 day ago)	Jun 13 12:37:29 nginx-mua ==smtp/[email protected]== : TRAKEUR-Out;0;127.0.0.1;104.28.152.239;[UNAVAI ... show more Jun 13 12:37:29 nginx-mua ==smtp/[email protected]== : TRAKEUR-Out;0;127.0.0.1;104.28.152.239;[UNAVAILABLE];[email protected];smtp;plain;1;@adlp.org$;KILL;2;Licence to kill Jun 13 12:37:32 nginx-mua ==smtp/[email protected]== : TRAKEUR-Out;0;127.0.0.1;104.28.152.239;[UNAVAILABLE];[email protected];smtp;plain;1;@adlp.org$;KILL;2;Licence to kill Jun 13 12:37:35 nginx-mua ==smtp/[email protected]== : TRAKEUR-Out;0;127.0.0.1;104.28.152.239;[UNAVAILABLE];[email protected];smtp;plain;1;@adlp.org$;KILL;2;Licence to kill ... show less	Brute-Force

Showing 1 to 15 of 66 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇦 200.46.177.242

🇧🇴 181.188.187.140

🇨🇴 179.19.13.207

🇰🇷 121.131.206.75

🇵🇰 103.104.87.34

🇩🇪 84.46.99.57

🇷🇴 80.94.92.187

🇮🇱 77.137.64.126

🇺🇸 65.49.20.102

🇮🇳 49.156.106.82

🇭🇰 47.238.188.245

🇦🇿 46.23.103.60

🇺🇸 45.156.129.68

🇧🇪 35.241.246.74

🇨🇱 34.176.116.103

🇺🇸 18.217.208.51

🇸🇬 203.116.129.55

🇬🇧 195.140.214.29

🇻🇳 180.93.43.225

🇳🇱 172.94.9.74