JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.157.196

104.28.157.196 was found in our database!

This IP was reported 63 times. Confidence of Abuse is 34%: ?

34%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.157.196

Whois 104.28.157.196

IP Abuse Reports for 104.28.157.196:

This IP address has been reported a total of 63 times from 38 distinct sources. 104.28.157.196 was first reported on November 23rd 2023, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 xveil	2026-05-20 20:40:30 (2 weeks ago)	2026-05-21T03:40:25.513435 mail-honeypot postfix/submission/smtpd[16201]: warning: unknown[104.28.15 ... show more 2026-05-21T03:40:25.513435 mail-honeypot postfix/submission/smtpd[16201]: warning: unknown[104.28.157.196]: SASL LOGIN authentication failed: authentication failure ... show less	Brute-Force
🇺🇸 Smee	2026-05-19 09:13:18 (2 weeks ago)	IMAP/SMTP Authentication Failure	Brute-Force
Anonymous	2026-05-16 09:58:29 (2 weeks ago)	2026-05-16T11:58:28.062881 biopolis.pcconsultant.it postfix/smtpd[1398706]: warning: unknown[104.28. ... show more 2026-05-16T11:58:28.062881 biopolis.pcconsultant.it postfix/smtpd[1398706]: warning: unknown[104.28.157.196]: SASL PLAIN authentication failed: authentication failure, [email protected] ... show less	Brute-Force
🇷🇴 gtheo99	2026-05-08 17:25:25 (3 weeks ago)	(cpanel) Failed cPanel login from 104.28.157.196 (KR/South Korea/-): 2 in the last 900 secs	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-06 03:55:37 (4 weeks ago)	(mod_security) mod_security (id:240335) triggered by 104.28.157.196 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 104.28.157.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 23:55:30.342345 2026] [security2:error] [pid 19862:tid 19862] [client 104.28.157.196:48757] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 104.28.157.196 (+1 hits since last alert)\|frogdesignmexico.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "frogdesignmexico.com"] [uri "/xmlrpc.php"] [unique_id "afq7stjVamieJKJg5zd2wAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2026-05-04 04:43:35 (1 month ago)	postfix-non-smtp-command - IP: 104.28.157.196 - time="2026-05-04T06:43:34+02:00" level=info msg="(5 ... show more postfix-non-smtp-command - IP: 104.28.157.196 - time="2026-05-04T06:43:34+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/postfix-non-smtp-command by ip 104.28.157.196 (HK/13335) : 4h ban on Ip 104.28.157.196" module=db show less	Email Spam
🇷🇴 iulianh	2026-04-29 02:02:22 (1 month ago)	25,465,587	Brute-Force SSH
🇮🇹 VHosting	2026-04-28 17:07:59 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇦🇺 aranguren.org	2026-04-22 13:28:47 (1 month ago)	104.28.157.196 - - [22/Apr/2026:23:28:45 +1000] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 985 ... show more 104.28.157.196 - - [22/Apr/2026:23:28:45 +1000] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 104.28.157.196 - - [22/Apr/2026:23:28:46 +1000] "GET /feed/ HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 104.28.157.196 - - [22/Apr/2026:23:28:46 +1000] "GET /xmlrpc.php?rsd HTTP/1.1" 404 16 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 104.28.157.196 - - [22/Apr/2026:23:28:46 +1000] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 104.28.157.196 - - [22/Apr/2026:23:28:46 +1000] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x ... show less	Bad Web Bot
🇺🇸 Hmorrin	2026-04-07 02:15:58 (1 month ago)		Port Scan
🇺🇸 xmission.com	2026-03-15 05:52:28 (2 months ago)	Blocked by UFW (TCP on 40292) Source port: 10418 TTL: 50 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 40292) Source port: 10418 TTL: 50 Packet length: 60 TOS: 0x08 This report (for 104.28.157.196) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-03-14 11:02:28 (2 months ago)	Blocked by UFW (TCP on 40292) Source port: 53831 TTL: 46 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 40292) Source port: 53831 TTL: 46 Packet length: 60 TOS: 0x08 This report (for 104.28.157.196) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇬🇧 consul.to	2026-03-02 04:12:16 (3 months ago)	Web attack/malicious scanning detected	Web App Attack
🇬🇧 OptimusGO	2026-01-26 01:31:42 (4 months ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-01-26 01:31:28 UTC Log evidence: 01/26/2026-01:31:27.375844 [] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 104.28.157.196:31217 -> 185.127.18.66:3003 show less	Port Scan Brute-Force
🇨🇳 ThreatBook.io	2025-11-08 22:42:05 (6 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/104.28.157.196 2025-11-08 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/104.28.157.196 2025-11-08 14:19:33 /WebReport/ReportServer?%6f%70=%63%68%61%72%74&%63%6d%64=%67%65%74%5f%67%65%6f%5f%6a%73%6f%6e&%72%65%73%6f%75%72%63%65%70%61%74%68=%70%72%69%76%69%6c%65%67%65%2e%78%6d%6c show less	Web App Attack

Showing 1 to 15 of 63 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a02:4780:f:b7ab::1

🇨🇳 223.96.185.96

🇧🇩 203.223.88.10

🇵🇱 194.180.49.71

🇨🇳 183.30.218.234

🇵🇰 182.182.232.33

🇰🇿 176.64.8.202

🇦🇫 149.54.16.186

🇺🇸 147.185.132.39

🇵🇰 115.186.50.92

🇵🇭 113.19.183.204

🇺🇬 102.218.89.110

🇰🇿 95.59.118.180

🇰🇿 91.234.209.54

🇰🇬 89.237.197.76

🇦🇿 89.23.124.141

🇰🇿 85.193.99.118

🇵🇰 39.63.66.76

🇬🇧 35.203.211.36

🇨🇳 14.153.35.167