JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 213.172.147.28

213.172.147.28 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 61%: ?

61%

ISP	HERO TELECOMS (PTY) LTD
Usage Type	Fixed Line ISP
ASN	AS328471
Domain Name	herotel.com
Country	🇿🇦 South Africa
City	Stellenbosch, Western Cape

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 213.172.147.28

Whois 213.172.147.28

IP Abuse Reports for 213.172.147.28:

This IP address has been reported a total of 18 times from 15 distinct sources. 213.172.147.28 was first reported on April 10th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇺 Darth Vader	2026-10-15 18:54:16 (1 day ago)	nfdump top talker: 213.172.147.28 \| first seen 2026-10-15 21:54:16 \| duration 328.448s \| flows=210 \| ... show more nfdump top talker: 213.172.147.28 \| first seen 2026-10-15 21:54:16 \| duration 328.448s \| flows=210 \| packets=458304 \| bytes=608627712 \| pps=1395 \| bps=14824330 \| bpp=1328 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇷🇺 Darth Vader	2026-10-15 16:19:28 (1 day ago)	nfdump top talker: 213.172.147.28 \| first seen 2026-10-15 19:19:28 \| duration 36.096s \| flows=20 \| p ... show more nfdump top talker: 213.172.147.28 \| first seen 2026-10-15 19:19:28 \| duration 36.096s \| flows=20 \| packets=48081 \| bytes=63851568 \| pps=1332 \| bps=14151500 \| bpp=1328 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇺🇸 TPI-Abuse	2026-10-14 18:05:18 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 213.172.147.28 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 213.172.147.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 14:05:11.603194 2026] [security2:error] [pid 5454:tid 5454] [client 213.172.147.28:39169] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|eye7graphics.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "eye7graphics.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "as_EVwdyiWQP3DpfRBsJOgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2026-10-14 17:56:57 (2 days ago)	http-probing - IP: 213.172.147.28 - time="2026-10-14T19:56:56+02:00" level=info msg="(555f66b4f6a74 ... show more http-probing - IP: 213.172.147.28 - time="2026-10-14T19:56:56+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 213.172.147.28 (ZA/328471) : 4h ban on Ip 213.172.147.28" module=db show less	Web App Attack
🇬🇧 Celtic	2026-10-14 15:12:42 (2 days ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
🇫🇮 YF	2026-10-14 14:00:57 (2 days ago)	WordPress author enumeration	Web App Attack
🇩🇪 FeG Deutschland	2026-10-13 23:35:46 (3 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 onyxdev	2026-10-13 19:20:42 (3 days ago)	Honeypot (telnet): 1 login attempt, 562 shell commands, 6 malware download attempts.	Hacking Brute-Force IoT Targeted
🇩🇪 Packets-Decreaser.NET	2026-10-12 15:33:52 (4 days ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇫🇷 LRob	2026-10-10 22:40:48 (6 days ago)	Not following 301 redirects — wasted requests \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 ... show more Not following 301 redirects — wasted requests \| method: GET \| path: /wp-login.php \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 15:26:42 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇳🇱 exxos	2025-07-31 03:28:38 (1 year ago)	HTTP1.x attacks	DDoS Attack
🇳🇱 exxos	2025-07-30 02:30:06 (1 year ago)	HTTP1.x attacks	DDoS Attack
🇫🇷 bigorre.org	2025-05-29 12:35:41 (1 year ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
Anonymous	2025-02-03 04:18:32 (1 year ago)	Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK	Brute-Force SSH

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 190.60.242.28

🇮🇷 185.75.204.123

🇨🇳 175.11.190.215

🇰🇷 140.238.16.177

🇻🇳 103.72.56.174

🇳🇱 85.203.40.83

🇺🇸 72.60.166.252

🇺🇸 52.167.144.222

🇬🇧 35.203.210.147

🇧🇪 34.79.131.66

🇨🇳 122.96.28.89

🇷🇴 2.57.121.25

🇬🇧 200.138.46.117

🇸🇬 193.37.32.32

🇳🇱 192.253.248.223

🇨🇳 180.165.54.95

🇰🇷 175.209.156.146

🇹🇼 111.70.32.8

🇮🇳 106.222.203.221

🇷🇴 92.118.39.50