JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.157.195

104.28.157.195 was found in our database!

This IP was reported 97 times. Confidence of Abuse is 11%: ?

11%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.157.195

Whois 104.28.157.195

IP Abuse Reports for 104.28.157.195:

This IP address has been reported a total of 97 times from 67 distinct sources. 104.28.157.195 was first reported on March 17th 2023, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-05-08 04:30:38 (1 month ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇮🇹 VHosting	2026-04-29 01:32:01 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇨🇭 Origon	2026-04-28 14:15:23 (1 month ago)	postfix-non-smtp-command - IP: 104.28.157.195 - time="2026-04-28T16:15:22+02:00" level=info msg="(5 ... show more postfix-non-smtp-command - IP: 104.28.157.195 - time="2026-04-28T16:15:22+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-non-smtp-command by ip 104.28.157.195 (HK/13335) : 4h ban on Ip 104.28.157.195" module=db show less	Email Spam
🇷🇴 gtheo99	2026-04-11 02:28:36 (2 months ago)	(smtpauth) Failed SMTP AUTH login from 104.28.157.195 (CA/Canada/-): 2 in the last 900 secs	Brute-Force Email Spam
🇫🇷 smtp.com.es	2026-03-31 05:35:50 (2 months ago)	Brute force attempt.	Brute-Force Email Spam
Anonymous	2026-03-24 22:49:57 (2 months ago)	2026-03-25T00:49:56.709424+02:00 soli-gate postfix/submission/smtpd[531851]: warning: unknown[104.28 ... show more 2026-03-25T00:49:56.709424+02:00 soli-gate postfix/submission/smtpd[531851]: warning: unknown[104.28.157.195]: SASL LOGIN authentication failed: authentication failure, [email protected] ... show less	Brute-Force
🇮🇳 liveaspankaj	2026-02-26 23:17:04 (3 months ago)	DDoS attack: 138 requests in 5m (GET / or repair.php).	DDoS Attack
🇩🇪 David Ferneding	2026-01-23 12:22:32 (4 months ago)	Blocked by UFW (TCP on 80) Source port: 60209 TTL: 58 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 60209 TTL: 58 Packet length: 60 TOS: 0x00 This report (for 104.28.157.195) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
Anonymous	2026-01-23 01:30:14 (4 months ago)	104.28.157.195 - - [23/Jan/2026:01:30:14 +0000] "GET /.vscode/sftp.json HTTP/1.1" 404 17117 "-" "Moz ... show more 104.28.157.195 - - [23/Jan/2026:01:30:14 +0000] "GET /.vscode/sftp.json HTTP/1.1" 404 17117 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Bad Web Bot Web App Attack
Anonymous	2025-10-11 07:07:12 (8 months ago)	Ports: 20,21,25,2525,53,80,110,143,443,465,587,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095, ... show more Ports: 20,21,25,2525,53,80,110,143,443,465,587,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,3306,2195; Direction: 0; Trigger: LF_CUSTOMTRIGGER show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-10-03 18:40:23 (8 months ago)	(mod_security) mod_security (id:217210) triggered by 104.28.157.195 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:217210) triggered by 104.28.157.195 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 03 14:40:17.558942 2025] [security2:error] [pid 12157:tid 12157] [client 104.28.157.195:45909] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|check.socks5.090227.xyz:80\|F\|4"] [data "CONNECT check.socks5.090227.xyz:80 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "check.socks5.090227.xyz"] [uri "/"] [unique_id "aOAYkdwYfl_QMFWUljpDJAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2025-09-03 17:35:32 (9 months ago)		DDoS Attack
🇨🇭 ScanThe.Net	2025-08-08 15:30:23 (10 months ago)	ID: 3786186978 \| PORT: 354 \| https://104-28-157-195.scanthe.net	Port Scan
Anonymous	2024-12-11 01:45:10 (1 year ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇨🇭 backslash	2024-11-28 14:10:06 (1 year ago)	block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68	Bad Web Bot

Showing 1 to 15 of 97 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 39.34.166.253

🇳🇱 217.60.195.150

🇧🇪 198.235.24.228

🇮🇳 167.71.239.213

🇷🇺 90.150.172.17

🇳🇱 45.148.10.157

🇳🇱 45.148.10.151

🇺🇸 34.60.63.99

🇬🇧 31.59.27.99

🇺🇸 8.230.122.229

🇮🇳 2401:4900:ca82:98bb:1162:f896:b458:8344

🇫🇷 172.71.118.237

🇿🇦 105.187.231.233

🇮🇩 103.98.176.164

🇺🇸 66.132.186.162

🇳🇱 64.225.72.42

🇱🇹 45.227.254.170

🇺🇸 195.184.76.137

🇩🇪 194.88.98.118

🇨🇳 175.19.52.56