JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 150.228.104.128

150.228.104.128 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 36%: ?

36%

ISP	SpaceX Services, Inc.
Usage Type	Fixed Line ISP
ASN	AS14593
Hostname(s)	customer.sfiabgr1.isp.starlink.com
Domain Name	spacex.com
Country	🇮🇶 Iraq
City	Baghdad, Baghdad

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 150.228.104.128

Whois 150.228.104.128

IP Abuse Reports for 150.228.104.128:

This IP address has been reported a total of 20 times from 16 distinct sources. 150.228.104.128 was first reported on July 26th 2026, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇸 pavel Karpenko	2026-10-11 20:00:53 (5 days ago)	150.228.104.128 - - [11/Oct/2026:23:00:53 +0300] "GET /transfer/?company_country=LT&counterparty_cou ... show more 150.228.104.128 - - [11/Oct/2026:23:00:53 +0300] "GET /transfer/?company_country=LT&counterparty_country=ES&country=LT&lang=de&months=12&share=6eda5a39517db157&view=countries HTTP/2.0" 302 0 "https://ultralir.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0" client_port=35693 server_port=443 rt=0.009 urt=0.009 transfer_entry=- server_addr=195.133.18.6 epoch=1791748853.846 show less	DDoS Attack
Anonymous	2026-10-09 07:06:38 (1 week ago)	denied SSH access attempt. destination port 22.	Port Scan Brute-Force SSH
🇩🇪 Tsumugi Kotobuki	2026-09-28 17:40:12 (2 weeks ago)	Port Scan on Honeypot \| Ports: 3306/MySQL \| Proto: TCP(1) \| Flags: all SYN \| TTL: 118 \| Len: 48B \| W ... show more Port Scan on Honeypot \| Ports: 3306/MySQL \| Proto: TCP(1) \| Flags: all SYN \| TTL: 118 \| Len: 48B \| Win: 8192(1) \| rDNS: customer.sfiabgr1.isp.starlink.com \| F2B/ufw-honeypot@2026-09-28T17:40:12Z show less	Port Scan Hacking
🇩🇪 Vegascosmetics	2026-09-26 18:02:09 (2 weeks ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local blo ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (60, Abuse: 51) show less	Hacking Exploited Host Web App Attack
🇩🇪 LRob	2026-09-19 09:52:51 (4 weeks ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: /notre-vision \| 2026-09-19 09:52 UTC show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-18 20:30:25 (4 weeks ago)	(mod_security) mod_security (id:210730) triggered by 150.228.104.128 (customer.sfiabgr1.isp.starlink ... show more (mod_security) mod_security (id:210730) triggered by 150.228.104.128 (customer.sfiabgr1.isp.starlink.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 16:30:19.744579 2026] [security2:error] [pid 13647:tid 13647] [client 150.228.104.128:53188] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|tulsatvmemories.com\|F\|2"] [data ".ktul.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tulsatvmemories.com"] [uri "/www.ktul.com"] [unique_id "aq2fW7ru6n66MnrFesp25AAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-18 01:32:14 (4 weeks ago)	suricata IPS/IDS detection, ruleset ET SCAN Potential SSH Scan	Port Scan
🇺🇸 NetVexor	2026-09-11 20:55:56 (1 month ago)	Attack source identified and submitted via NetVexor BGP Blackhole Network	Port Scan Hacking Brute-Force
🇩🇪 Vegascosmetics	2026-08-23 06:31:19 (1 month ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local blo ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (60, Abuse: 51) show less	Hacking Exploited Host Web App Attack
🇫🇷 Zkillu	2026-08-19 22:26:25 (1 month ago)	UDP flood (DDoS) vs AS215599: 92 pkts / 0.13 MB to UDP 80/8443 across 74 dst IP(s), 2026-08-19 21:46 ... show more UDP flood (DDoS) vs AS215599: 92 pkts / 0.13 MB to UDP 80/8443 across 74 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇩🇪 Ilop	2026-08-18 00:06:09 (1 month ago)	[hp-100] 2 unsolicited packets to honeypot ports 22,23 (OCI DShield sensor)	Port Scan
🇫🇷 sthoyer.de	2026-08-17 12:51:09 (2 months ago)	Aug 17 14:51:07 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f ... show more Aug 17 14:51:07 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=150.228.104.128 DST=173.212.223.67 LEN=60 TOS=0x00 PREC=0x20 TTL=52 ID=39895 DF PROTO=TCP SPT=8465 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 milcraft.nl	2026-08-17 09:24:46 (2 months ago)	Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi ... show more Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse. show less	DDoS Attack Web App Attack
🇫🇷 security.rdmc.fr	2026-08-16 09:57:15 (2 months ago)	Port Scan Attack proto:TCP src:46468 dst:23	Port Scan
Anonymous	2026-08-15 06:05:08 (2 months ago)	denied Telnet access attempt. destination port 23.	Port Scan Brute-Force

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 171.104.158.177

🇨🇳 171.104.83.187

🇰🇷 119.192.210.110

🇨🇳 118.183.180.108

🇳🇱 45.148.10.152

🇳🇱 45.148.10.141

🇧🇪 34.14.122.221

🇸🇬 193.37.32.203

🇦🇷 186.158.183.66

🇰🇷 20.194.31.140

🇺🇸 20.83.60.59

🇨🇭 209.99.190.186

🇸🇬 209.74.81.130

🇮🇳 200.141.6.62

🇲🇽 187.216.224.85

🇵🇦 179.43.153.2

🇺🇸 172.172.30.159

🇦🇷 138.121.83.70

🇺🇸 73.91.249.30

🇮🇩 69.5.20.133