JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.213.40

104.28.213.40 was found in our database!

This IP was reported 1,354 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.213.40

Whois 104.28.213.40

IP Abuse Reports for 104.28.213.40:

This IP address has been reported a total of 1,354 times from 532 distinct sources. 104.28.213.40 was first reported on February 21st 2024, and the most recent report was 59 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 michael liem	2026-01-10 08:46:02 (4 months ago)	SSH brute force attack detected by Fail2ban on port 2022	Brute-Force SSH
🇩🇪 michael liem	2026-01-08 00:14:15 (4 months ago)	SSH brute force attack detected by Fail2ban on port 2022	Brute-Force SSH
🇩🇪 michael liem	2025-12-19 08:13:27 (5 months ago)	SSH brute force attack detected by Fail2ban on port 2022	Brute-Force SSH
🇩🇪 michael liem	2025-12-15 06:53:09 (5 months ago)	SSH brute force attack detected by Fail2ban on port 2022	Brute-Force SSH
🇩🇪 michael liem	2025-12-11 05:17:25 (5 months ago)	SSH brute force attack detected by Fail2ban on port 2022	Brute-Force SSH
🇩🇪 michael liem	2025-12-09 13:54:33 (5 months ago)	SSH brute force attack detected by Fail2ban on port 2022	Brute-Force SSH
🇳🇱 wlt-blocker	2025-11-16 22:51:28 (6 months ago)	Attempts to login to mail server with wrong username and/or password	Brute-Force
🇨🇳 ThreatBook.io	2025-11-15 23:30:51 (6 months ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/104.28.213.40	SSH
🇫🇷 SpaceHost-Server	2025-11-15 23:26:24 (6 months ago)		Brute-Force Web App Attack
🇹🇷 rtbh.com.tr	2025-11-15 20:09:56 (6 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇨🇭 TOCE	2025-11-15 05:03:18 (6 months ago)	12 hits seen on 2025-11-15, ports 22 (SSH) on a honeypot from www.toce.ch	SSH
🇺🇸 yzfdude1	2025-11-15 04:57:47 (6 months ago)	Nov 14 21:54:14 b146-36 sshd[3693551]: Failed password for invalid user usuario from 104.28.213.40 p ... show more Nov 14 21:54:14 b146-36 sshd[3693551]: Failed password for invalid user usuario from 104.28.213.40 port 23450 ssh2 Nov 14 21:57:45 b146-36 sshd[3693981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root Nov 14 21:57:46 b146-36 sshd[3693981]: Failed password for root from 104.28.213.40 port 39462 ssh2 ... show less	Brute-Force SSH
🇫🇮 quita.ch	2025-11-15 04:23:39 (6 months ago)	2025-11-15T06:15:22.532444+02:00 quita sshd[182060]: Failed password for root from 104.28.213.40 por ... show more 2025-11-15T06:15:22.532444+02:00 quita sshd[182060]: Failed password for root from 104.28.213.40 port 36635 ssh2 2025-11-15T06:22:13.492689+02:00 quita sshd[182090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root 2025-11-15T06:22:15.271817+02:00 quita sshd[182090]: Failed password for root from 104.28.213.40 port 47375 ssh2 2025-11-15T06:23:36.567855+02:00 quita sshd[182092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root 2025-11-15T06:23:38.407323+02:00 quita sshd[182092]: Failed password for root from 104.28.213.40 port 22227 ssh2 ... show less	Brute-Force SSH
🇺🇸 bigscoots.com	2025-11-15 04:16:44 (6 months ago)	104.28.213.40 (EG/Egypt/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Port ... show more 104.28.213.40 (EG/Egypt/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Nov 14 21:17:43 14535 sshd[22396]: Failed password for root from 111.161.98.161 port 57790 ssh2 Nov 14 21:17:55 14535 sshd[22561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.136.15.178 user=root Nov 14 21:17:57 14535 sshd[22561]: Failed password for root from 80.136.15.178 port 61903 ssh2 Nov 14 21:19:11 14535 sshd[22711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.136.15.178 user=root Nov 14 22:16:30 14535 sshd[27493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 user=root IP Addresses Blocked: 111.161.98.161 (dns161.online.tj.cn) 80.136.15.178 (DE/Germany/p50880fb2.dip0.t-ipconnect.de) show less	Brute-Force SSH
🇩🇪 nohacefaltapapel-et.net	2025-11-15 04:06:40 (6 months ago)	2025-11-15T05:03:59.818702milloweb sshd[20503]: pam_unix(sshd:auth): authentication failure; logname ... show more 2025-11-15T05:03:59.818702milloweb sshd[20503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.213.40 2025-11-15T05:04:01.743665milloweb sshd[20503]: Failed password for invalid user jia from 104.28.213.40 port 62833 ssh2 2025-11-15T05:06:40.354634milloweb sshd[20730]: Invalid user cy from 104.28.213.40 port 21030 ... show less	Brute-Force SSH

Showing 136 to 150 of 1354 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 118.193.64.15

🇸🇬 103.187.146.72

🇷🇺 95.110.113.110

🇺🇸 91.230.168.87

🇮🇳 66.116.225.113

🇰🇷 61.76.112.4

🇱🇹 45.227.254.170

🇧🇷 45.205.1.73

🇺🇸 24.144.118.102

🇺🇸 13.89.124.223

🇸🇬 209.97.173.145

🇧🇷 205.210.31.250

🇺🇸 205.210.31.29

🇧🇾 178.120.8.38

🇸🇬 139.99.52.218

🇮🇳 117.198.58.12

🇸🇬 103.187.146.107

🇺🇸 66.132.195.62

🇳🇱 45.148.10.151

🇺🇸 43.166.186.194