JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.213.38

104.28.213.38 was found in our database!

This IP was reported 268 times. Confidence of Abuse is 31%: ?

31%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.213.38

Whois 104.28.213.38

IP Abuse Reports for 104.28.213.38:

This IP address has been reported a total of 268 times from 177 distinct sources. 104.28.213.38 was first reported on February 26th 2024, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 edgeshield	2026-10-13 09:37:16 (1 week ago)	Automated web request flooding / DDoS (EdgeShield WAF).	DDoS Attack
🇩🇪 Packets-Decreaser.NET	2026-10-11 23:28:38 (1 week ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇩🇪 numberstorm	2026-10-04 22:42:17 (2 weeks ago)	Honeypot trap triggered: unsolicited TCP connection(s) to unused port(s) 23 on a host running no suc ... show more Honeypot trap triggered: unsolicited TCP connection(s) to unused port(s) 23 on a host running no such service. There is no legitimate reason to connect to these ports. Observed 1 connection(s) from 2026-10-04T20:32:22Z to 2026-10-04T20:32:22Z UTC. 2026-10-04T20:32:22Z tcp/23 data: GET / HTTP/1.0 Accept-Encoding: gzip, deflate, br Accept-L... Connection was blocked automatically at the firewall. Reported by an automated honeypot. show less	Port Scan Hacking Brute-Force IoT Targeted
🇺🇸 LSPCCU	2026-09-24 00:56:11 (4 weeks ago)	TSEC Honeypot Network report. Threat score: 70/100. Categories: Hacking. Honeypot: galah. Context: 1 ... show more TSEC Honeypot Network report. Threat score: 70/100. Categories: Hacking. Honeypot: galah. Context: 104.28.213.38 classified as attacker with unclear intent (high confidence). show less	Hacking
🇩🇪 edgeshield	2026-09-21 21:15:37 (1 month ago)	Automated web request flooding / DDoS (EdgeShield WAF).	DDoS Attack
🇪🇸 akarguard.net	2026-09-17 20:31:34 (1 month ago)	Reported by Akarguard DDoS protection: this IP exceeded the per-IP rate limit at our reverse-proxy e ... show more Reported by Akarguard DDoS protection: this IP exceeded the per-IP rate limit at our reverse-proxy edge (repeated HTTP 444), consistent with an automated Layer 7 flood. show less	DDoS Attack Web App Attack
🇮🇹 VHosting	2026-09-15 23:20:03 (1 month ago)	Detected mail brute force attack from different servers	Brute-Force
🇿🇦 maximonline.co.za	2026-09-10 23:42:03 (1 month ago)	Brute Force IMAP AUTH Attack	Brute-Force
🇩🇪 anycast_ac	2026-07-23 22:29:38 (2 months ago)	[DDoS Attacker] This IP was attacking website anycast.ac and sent 32 requests on port 443	DDoS Attack Web App Attack
🇮🇹 Progetto1	2026-07-14 19:23:02 (3 months ago)	Mail - Multiple failed login attempts	Brute-Force Exploited Host
🇮🇹 VHosting	2026-07-14 00:51:21 (3 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇧🇷 ICS Labs	2026-06-30 13:46:20 (3 months ago)	ICS Labs identified 104.28.213.38 as a malicious indicator from threat intelligence.	DDoS Attack Port Scan Hacking Brute-Force Exploited Host
🇨🇿 lp	2026-06-17 00:19:04 (4 months ago)	SSH Brute force: 1 attempts were recorded from 104.28.213.38 2026-06-17T02:05:14+02:00 Invalid user ... show more SSH Brute force: 1 attempts were recorded from 104.28.213.38 2026-06-17T02:05:14+02:00 Invalid user user2 from 104.28.213.38 port 10155 show less	Brute-Force SSH
🇺🇸 bigscoots.com	2026-06-16 23:54:40 (4 months ago)	104.28.213.38 (EG/Egypt/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Port ... show more 104.28.213.38 (EG/Egypt/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jun 16 18:11:11 14969 sshd[14585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root Jun 16 18:11:13 14969 sshd[14585]: Failed password for root from 104.28.213.40 port 24393 ssh2 Jun 16 18:26:48 14969 sshd[23447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root Jun 16 18:14:16 14969 sshd[16284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root Jun 16 18:14:18 14969 sshd[16284]: Failed password for root from 104.28.213.40 port 46704 ssh2 Jun 16 18:54:38 14969 sshd[6316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.38 user=root IP Addresses Blocked: 104.28.213.40 (EG/Egypt/-) show less	Brute-Force SSH
🇯🇵 demonsword	2026-05-11 20:33:41 (5 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: ipv4.icanhazip.com:443 show less	Open Proxy Port Scan

Showing 1 to 15 of 268 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.239

🇺🇸 153.75.82.191

🇨🇭 82.21.4.178

🇳🇱 77.239.124.67

🇬🇧 45.82.76.137

🇭🇰 43.248.10.90

🇧🇪 34.156.206.32

🇺🇸 23.252.112.35

🇺🇸 20.84.123.15

🇨🇳 219.153.113.100

🇳🇱 195.178.110.247

🇦🇷 186.131.182.179

🇫🇷 185.194.178.86

🇳🇱 138.226.239.10

🇵🇭 122.3.6.113

🇲🇾 115.164.33.127

🇷🇴 80.94.95.109

🇪🇬 41.65.74.21

🇲🇲 37.111.41.74

🇺🇸 23.92.26.77