JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.158.52

104.28.158.52 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 32%: ?

32%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.158.52

Whois 104.28.158.52

IP Abuse Reports for 104.28.158.52:

This IP address has been reported a total of 56 times from 38 distinct sources. 104.28.158.52 was first reported on February 11th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 VHosting	2026-04-10 16:50:19 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇳🇱 MM-bot	2026-03-30 22:28:55 (2 months ago)	URL-probe: HTTP/1.1 POST request on /xmlrpc.php (2026-03-31 00:28:55 UTC+2)	Web App Attack Hacking
🇺🇸 xmission.com	2026-03-26 09:10:28 (2 months ago)	Blocked by UFW (TCP on 6610) Source port: 55844 TTL: 50 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 6610) Source port: 55844 TTL: 50 Packet length: 60 TOS: 0x08 This report (for 104.28.158.52) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇬🇧 OptimusGO	2026-02-05 16:10:52 (3 months ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-02-05 16:10:42 UTC Log evidence: 02/05/2026-16:10:41.378081 [] [1:1000101:2] SECURITY Port Scan Detected - Multiple Unauthorized Ports [] [Classification: Attempted Information Leak] [Priority: 1] {TCP} 104.28.158.52:41068 -> 185.127.18.66:3003 show less	Port Scan Brute-Force
🇩🇪 marzzzello	2025-12-13 04:54:14 (5 months ago)	Ports: 24x 59533	Port Scan
🇩🇪 marzzzello	2025-12-08 05:46:06 (5 months ago)	Ports: 24x 28084	Port Scan
🇺🇸 xmission.com	2025-11-20 10:01:24 (6 months ago)	Blocked by UFW (TCP on 1090) Source port: 38242 TTL: 49 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 1090) Source port: 38242 TTL: 49 Packet length: 60 TOS: 0x08 This report (for 104.28.158.52) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2025-10-26 14:48:00 (7 months ago)	Blocked by UFW (TCP on 51413) Source port: 36391 TTL: 48 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 51413) Source port: 36391 TTL: 48 Packet length: 60 TOS: 0x08 This report (for 104.28.158.52) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇸🇰 GOVCERT	2025-10-23 08:08:25 (7 months ago)	SMB Port Scan	Port Scan
🇺🇸 TPI-Abuse	2025-10-03 19:06:16 (8 months ago)	(mod_security) mod_security (id:217210) triggered by 104.28.158.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:217210) triggered by 104.28.158.52 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 03 15:06:08.871555 2025] [security2:error] [pid 24940:tid 24940] [client 104.28.158.52:31030] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|check.socks5.090227.xyz:80\|F\|4"] [data "CONNECT check.socks5.090227.xyz:80 HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "check.socks5.090227.xyz"] [uri "/"] [unique_id "aOAeoIfpeN_uih-4RnCfNAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-10-01 05:24:14 (8 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
Anonymous	2025-09-16 06:59:05 (8 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇨🇭 backslash	2025-09-03 17:35:33 (9 months ago)		DDoS Attack
Anonymous	2025-06-09 06:16:55 (11 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2025-02-23 02:55:25 (1 year ago)	Des tentatives de connexion refusées ont été détectées depuis l'IP 104.28.158.52 le 2025-02-23T02:55 ... show more Des tentatives de connexion refusées ont été détectées depuis l'IP 104.28.158.52 le 2025-02-23T02:55:25Z UTC vers le(s) port(s) 61536. Action prise : deny. Catégories : 15. show less	Hacking

Showing 16 to 30 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 223.233.68.79

🇨🇳 180.153.236.52

🇫🇮 147.185.133.190

🇨🇳 120.34.139.7

🇷🇼 41.186.188.100

🇳🇱 193.176.31.150

🇨🇭 186.190.215.90

🇺🇸 162.216.150.66

🇺🇸 162.216.150.5

🇫🇷 91.231.89.106

🇺🇸 66.132.172.187

🇧🇪 34.62.139.130

🇳🇱 4.175.1.202

🇰🇷 220.78.240.246

🇦🇷 148.222.130.63

🇭🇰 124.156.129.246

🇸🇪 78.66.44.23

🇺🇸 74.7.229.154

🇰🇷 58.229.141.26

🇮🇳 42.111.111.3