JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.156.213

104.28.156.213 was found in our database!

This IP was reported 73 times. Confidence of Abuse is 36%: ?

36%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.156.213

Whois 104.28.156.213

IP Abuse Reports for 104.28.156.213:

This IP address has been reported a total of 73 times from 37 distinct sources. 104.28.156.213 was first reported on February 20th 2023, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 pengpeng	2026-06-29 09:59:47 (2 days ago)	monitor: on VM-0-7-ubuntu \| port: 24581 \| ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporte ... show more monitor: on VM-0-7-ubuntu \| port: 24581 \| ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇮🇹 Progetto1	2026-06-18 17:54:02 (1 week ago)	Mail - Multiple failed login attempts	Brute-Force Exploited Host
🇬🇧 knock	2026-06-14 17:33:37 (2 weeks ago)	Knock-Knock honeypot brute-force: proto8 (2 total hits)	Brute-Force
Anonymous	2026-06-13 13:34:52 (2 weeks ago)	104.28.156.213 - - [13/Jun/2026:15:34:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack by ... show more 104.28.156.213 - - [13/Jun/2026:15:34:31 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" 104.28.156.213 - - [13/Jun/2026:15:34:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.4)" 104.28.156.213 - - [13/Jun/2026:15:34:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack/12.1; WordPress/6.2; http://site46212694.com" 104.28.156.213 - - [13/Jun/2026:15:34:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/12.1; WordPress/6.2; http://site46212694.com" 104.28.156.213 - - [13/Jun/2026:15:34:51 +0200] "POST /xmlrpc.php HTTP/1.1" 200 624 "-" "Jetpack/13.0; WordPress/6.4; http://site23817284.com" ... show less	Brute-Force Web App Attack
🇧🇷 dominioz	2026-06-13 09:26:41 (2 weeks ago)	2026-06-13 09:25:40 POST /xmlrpc.php - - 104.28.156.213 HTTP/1.1 Jetpack/12.5;+WordPress/6.3;+http:/ ... show more 2026-06-13 09:25:40 POST /xmlrpc.php - - 104.28.156.213 HTTP/1.1 Jetpack/12.5;+WordPress/6.3;+http://site12131870.com - 200 0 2026-06-13 09:25:49 POST /xmlrpc.php - - 104.28.156.213 HTTP/1.1 WordPress.com;+https://wordpress.com - 200 650 2026-06-13 09:25:58 POST /xmlrpc.php - - 104.28.156.213 HTTP/1.1 Jetpack/12.1;+WordPress/6.4;+http://site16963734.com - 200 650 2026-06-13 09:26:09 POST /xmlrpc.php - - 104.28.156.213 HTTP/1.1 WordPress.com;+https://wordpress.com - 200 650 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 12:02:01 (3 weeks ago)	(mod_security) mod_security (id:240335) triggered by 104.28.156.213 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 104.28.156.213 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 08:01:53.704347 2026] [security2:error] [pid 19204:tid 19204] [client 104.28.156.213:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.28.156.213 (+1 hits since last alert)\|upskirtcrazy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "upskirtcrazy.com"] [uri "/xmlrpc.php"] [unique_id "aiK6sfqr2fBenOjc4LFlygAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 piticu iuli	2026-06-03 02:58:07 (4 weeks ago)	(ftpd) Failed FTP login from 104.28.156.213 (HK/Hong Kong/-)	FTP Brute-Force Brute-Force
🇨🇭 Origon	2026-05-23 19:45:17 (1 month ago)	postfix-non-smtp-command - IP: 104.28.156.213 - time="2026-05-23T21:45:17+02:00" level=info msg="(5 ... show more postfix-non-smtp-command - IP: 104.28.156.213 - time="2026-05-23T21:45:17+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-non-smtp-command by ip 104.28.156.213 (HK/13335) : 4h ban on Ip 104.28.156.213" module=db show less	Email Spam
🇨🇭 Origon	2026-04-28 14:03:48 (2 months ago)	postfix-non-smtp-command - IP: 104.28.156.213 - time="2026-04-28T16:03:47+02:00" level=info msg="(5 ... show more postfix-non-smtp-command - IP: 104.28.156.213 - time="2026-04-28T16:03:47+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-non-smtp-command by ip 104.28.156.213 (HK/13335) : 4h ban on Ip 104.28.156.213" module=db show less	Email Spam
🇷🇴 iulianh	2026-04-28 13:25:35 (2 months ago)	25,465,587	Brute-Force SSH
🇷🇴 gtheo99	2026-04-27 02:35:56 (2 months ago)	104.28.156.213 (CA/Canada/-), 3 distributed smtpauth attacks on account [[email protected]] in the las ... show more 104.28.156.213 (CA/Canada/-), 3 distributed smtpauth attacks on account [[email protected]] in the last 900 secs show less	SSH Brute-Force Hacking
🇮🇹 VHosting	2026-04-26 08:47:33 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇬🇧 OptimusGO	2026-04-20 15:29:51 (2 months ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-04-20 16:29:51 UTC Log evidence: show less	Port Scan Brute-Force
🇬🇧 OptimusGO	2026-04-18 00:05:57 (2 months ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-04-18 01:05:57 UTC Log evidence: show less	Port Scan Brute-Force
Anonymous	2026-04-16 10:24:37 (2 months ago)	Aggressive web scan	Web App Attack

Showing 1 to 15 of 73 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 92.118.39.77

🇫🇷 51.159.95.78

🇺🇸 40.124.175.188

🇮🇳 2404:6800:4000:1000::120

🇸🇪 155.4.244.179

🇦🇹 109.70.100.11

🇭🇰 103.243.24.124

🇺🇬 196.0.3.188

🇺🇸 193.56.116.138

🇨🇦 172.70.80.191

🇻🇳 103.200.25.79

🇺🇸 65.49.1.48

🇬🇧 5.226.140.57

🇨🇳 223.107.169.122

🇨🇳 222.128.80.201

🇨🇳 221.198.99.117

🇮🇩 180.252.246.158

🇮🇳 163.5.191.129

🇺🇸 161.0.2.182

🇺🇸 144.172.97.164