JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.221.99

104.28.221.99 was found in our database!

This IP was reported 685 times. Confidence of Abuse is 19%: ?

19%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇮🇩 Indonesia
City	Palembang, South Sumatra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.221.99

Whois 104.28.221.99

IP Abuse Reports for 104.28.221.99:

This IP address has been reported a total of 685 times from 245 distinct sources. 104.28.221.99 was first reported on May 25th 2023, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 gooko	2026-05-11 13:47:46 (3 weeks ago)	SSH brute-force attack detected by fail2ban jail 'sshd'	Brute-Force SSH
🇮🇳 evicky2002	2026-05-05 06:00:00 (1 month ago)	Confirmed malicious by STILWaters CTI platform (score=86, sources=1)	Hacking Brute-Force SSH
Anonymous	2026-05-04 03:24:26 (1 month ago)	Mar 3 13:21:28 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 Mar 3 14:50 ... show more Mar 3 13:21:28 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 Mar 3 14:50:42 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 Mar 3 16:13:13 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 show less	Brute-Force SSH
🇺🇸 TTWebhosting	2026-05-02 00:29:06 (1 month ago)	(pop3d) Failed POP3 login from 104.28.221.99 (ID/Indonesia/South Sumatra/Palembang/-/[AS13335 Cloudf ... show more (pop3d) Failed POP3 login from 104.28.221.99 (ID/Indonesia/South Sumatra/Palembang/-/[AS13335 Cloudflare, Inc.]): 1 in the last 3600 secs show less	Brute-Force Port Scan Hacking
🇺🇸 NXTwoThou	2026-04-28 16:22:41 (1 month ago)	FTP	FTP Brute-Force
Anonymous	2026-04-18 01:15:27 (1 month ago)	Mar 3 13:21:28 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 Mar 3 14:50 ... show more Mar 3 13:21:28 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 Mar 3 14:50:42 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 Mar 3 16:13:13 mail fail2ban.actions [619]: NOTICE [dovecot] Ban 104.28.221.99 show less	Brute-Force SSH
🇸🇰 Spyerfox	2026-04-07 08:27:44 (1 month ago)	Apr 7 10:27:41 <server> sshd\[19701\]: User root from 104.28.221.99 not allowed because not listed ... show more Apr 7 10:27:41 <server> sshd\[19701\]: User root from 104.28.221.99 not allowed because not listed in AllowUsersApr 7 10:27:43 <server> sshd\[19701\]: Failed password for invalid user root from 104.28.221.99 port 9629 ssh2 ... show less	Brute-Force SSH
Anonymous	2026-04-07 06:36:38 (2 months ago)	2026-04-07T08:36:37.867614+02:00 zanati sshd[4051]: Invalid user sahpa from 104.28.221.99 port 52360 ... show more 2026-04-07T08:36:37.867614+02:00 zanati sshd[4051]: Invalid user sahpa from 104.28.221.99 port 52360 ... show less	Brute-Force SSH
🇫🇷 dwmp	2026-04-07 05:37:57 (2 months ago)	2026-04-07T01:22:29.214392+01:00 galileo.dwmp.it auth[2324639]: pam_unix(dovecot:auth): authenticati ... show more 2026-04-07T01:22:29.214392+01:00 galileo.dwmp.it auth[2324639]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=104.28.221.99 2026-04-07T01:22:33.268304+01:00 galileo.dwmp.it dovecot[1879399]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=161.97.99.110, TLS, session=<635Px9NOmONoHN1j> 2026-04-07T06:37:56.157542+01:00 galileo.dwmp.it auth[2345358]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=104.28.221.99 ... show less	Brute-Force
🇷🇴 TerraCorp Global Solutions	2026-04-07 04:40:53 (2 months ago)	2026-04-07T07:40:52.542663+03:00 honeypot.mkwayexchange.com auth[334782]: pam_unix(dovecot:auth): au ... show more 2026-04-07T07:40:52.542663+03:00 honeypot.mkwayexchange.com auth[334782]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [email protected] rhost=104.28.221.99 ... show less	Brute-Force Exploited Host Web App Attack SSH
🇫🇷 dwmp	2026-04-07 04:38:44 (2 months ago)	Apr 7 02:02:19 webcore dovecot: imap-login: Login aborted: Connection closed (auth failed, 1 attemp ... show more Apr 7 02:02:19 webcore dovecot: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=75.119.153.41, TLS, session=<Mtv/ftNOZe9oHN1j> Apr 7 06:03:19 webcore dovecot: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=75.119.153.41, TLS, session=<POSw3NZOuPZoHN1j> Apr 7 06:38:43 webcore dovecot: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=75.119.153.41, TLS, session=<tTGFW9dO2ndoHN1j> ... show less	Brute-Force
🇺🇸 Brian Minton	2026-04-07 03:13:21 (2 months ago)	2026-04-06T18:12:57.581053-05:00 lab dovecot: imap-login: Disconnected: Connection closed (auth fail ... show more 2026-04-06T18:12:57.581053-05:00 lab dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=199.181.238.151, TLS, session=<dDtiztJOZltoHN1j> 2026-04-06T18:47:27.637433-05:00 lab dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=199.181.238.151, TLS, session=<q3nXSdNOT+JoHN1j> 2026-04-06T21:24:12.226835-05:00 lab dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=199.181.238.151, TLS, session=<MohbetVOwC5oHN1j> 2026-04-06T21:53:02.123162-05:00 lab dovecot: imap-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=104.28.221.99, lip=199.181.238.151, TLS handshaking: Connection closed, session=<itq24dVO2YloHN1j> 2026-04-06T22:13:20.426688-05:00 lab ... show less	Brute-Force
🇷🇴 TerraCorp Global Solutions	2026-04-07 01:21:59 (2 months ago)	2026-04-07T04:21:58.262103+03:00 honeypot.mkwayexchange.com dovecot[2530]: imap-login: Disconnected: ... show more 2026-04-07T04:21:58.262103+03:00 honeypot.mkwayexchange.com dovecot[2530]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=192.168.0.216, TLS, session=<6hzYm9ROILloHN1j> ... show less	Phishing Hacking Brute-Force Exploited Host Web App Attack SSH
🇫🇷 solution.it	2026-04-07 00:25:48 (2 months ago)	Apr 7 02:25:47 vps789997 dovecot: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): use ... show more Apr 7 02:25:47 vps789997 dovecot: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=<[email protected]>, method=PLAIN, rip=104.28.221.99, lip=51.77.194.251, TLS, session=<BfLg0tNO551oHN1j> show less	Brute-Force
🇳🇱 nikki101	2026-04-06 23:42:54 (2 months ago)	pop/imap unauthorized access attempt, inappropriate conduct	Email Spam Brute-Force

Showing 1 to 15 of 685 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 179.51.153.37

🇻🇳 45.117.177.47

🇺🇸 40.121.179.100

🇺🇸 143.244.175.207

🇵🇭 136.158.10.67

🇸🇬 118.139.164.171

🇮🇳 103.194.243.199

🇺🇿 89.236.217.150

🇺🇿 87.237.237.188

🇱🇹 81.30.98.144

🇸🇬 47.245.89.93

🇨🇦 20.220.32.136

🇺🇸 2604:a940:301:225:0:1e::

🇺🇸 2604:a940:300:5b6:0:2a::

🇵🇰 2400:adc1:4ad:d000:99c2:a088:2d22:18c6

🇨🇳 123.13.41.128

🇮🇱 82.102.165.200

🇸🇬 47.237.13.79

🇻🇳 14.177.234.3

🇷🇺 172.70.136.149