JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.251.180.164

104.251.180.164 was found in our database!

This IP was reported 638 times. Confidence of Abuse is 100%: ?

100%

ISP	SKN Subnet & Telecom Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS402253
Domain Name	skntelecom.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.251.180.164

Whois 104.251.180.164

IP Abuse Reports for 104.251.180.164:

This IP address has been reported a total of 638 times from 106 distinct sources. 104.251.180.164 was first reported on May 17th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 podril1ak2.ru	2026-06-12 19:38:16 (3 hours ago)	Blocked by UFW on reporterUS [5900/tcp] \| SPT: 37606 \| TTL: 243 \| LEN: 40 \| TOS: 0x00 • Reported by: ... show more Blocked by UFW on reporterUS [5900/tcp] \| SPT: 37606 \| TTL: 243 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇳🇱 Yachiyo Runami	2026-06-12 19:15:10 (3 hours ago)	Port Scan on Honeypot \| Ports: 5900/VNC \| Proto: TCP(1) \| Flags: all SYN \| TTL: 244 \| Len: 40B \| Win ... show more Port Scan on Honeypot \| Ports: 5900/VNC \| Proto: TCP(1) \| Flags: all SYN \| TTL: 244 \| Len: 40B \| Win: 65535(1) \| F2B/ufw-honeypot@2026-06-12T19:15:10Z show less	Port Scan Hacking
🇳🇴 tmiland	2026-06-12 18:48:38 (4 hours ago)	Suricata Detected 38 attacks from 104.251.180.164.; ET DROP Spamhaus DROP Listed Traffic Inbound gro ... show more Suricata Detected 38 attacks from 104.251.180.164.; ET DROP Spamhaus DROP Listed Traffic Inbound group 22; IP: 104.251.180.164; Ports: 60205; Direction: to_server; Trigger: DROP; Category: Misc Attack; Severity: 2 show less	Brute-Force
🇺🇸 MPL	2026-06-12 18:16:03 (4 hours ago)	tcp/5900 (47 or more attempts)	Port Scan
🇷🇺 Agrohim	2026-06-12 18:10:02 (4 hours ago)	Gate I blocked for categories:	DDoS Attack Ping of Death Port Scan Hacking Brute-Force
🇺🇸 RAP	2026-06-12 17:18:20 (5 hours ago)	2026-06-12 17:18:20 UTC Unauthorized activity to TCP port 5900.	Port Scan
🇩🇪 iNetWorker	2026-06-12 16:10:46 (6 hours ago)	firewall-block, port(s): 5900/tcp	Port Scan
🇨🇭 SOC [GOLINE SA]	2026-06-12 14:58:36 (7 hours ago)	[RoutePulse \| 2026-06-12T14:58:36Z] ATTACK: Threat IP Active SOURCE: 104.251.180.164 · AS402253 SKN ... show more [RoutePulse \| 2026-06-12T14:58:36Z] ATTACK: Threat IP Active SOURCE: 104.251.180.164 · AS402253 SKN Subnet & Telecom Ltd · Switzerland EVIDENCE: severity=critical · 179 flows · 67 KB INTEL: AbuseIPDB 100% (545 reports) \| feeds: Wazuh SIEM — Suricata IDS,FireHOL Level 1,Spamhaus DROP (6) \| RoutePulse score 80/100 CONVICTION: Tier 4, LLR -0.38, 1.8 independent groups (multi-source SPRT) MITRE: T1071 Application Layer Protocol DETECTION: sFlow/IPFIX flow analysis + 14-detector ML stack (6-model weighted ensemble) + threat-intel correlation ACTION: Pre-blackhole intelligence report (live monitoring continues) show less	Hacking Exploited Host
🇩🇪 genokrad	2026-06-12 14:04:31 (8 hours ago)	Unauthorized connection attempt on TCP/5900 (VNC)	Port Scan
🇧🇷 diego	2026-06-12 13:14:39 (9 hours ago)	[rede-168-134] 06/12/2026-10:14:39.213116, 104.251.180.164, Protocol: 6, ET DROP Spamhaus DROP Liste ... show more [rede-168-134] 06/12/2026-10:14:39.213116, 104.251.180.164, Protocol: 6, ET DROP Spamhaus DROP Listed Traffic Inbound group 22 show less	Hacking
🇧🇷 SSP	2026-06-12 11:45:33 (11 hours ago)	Automatically generated from firewall_v2 logs on Server_ID: SPPX01 Category: Brute Force Occurrenc ... show more Automatically generated from firewall_v2 logs on Server_ID: SPPX01 Category: Brute Force Occurrences: 12 Unique Ports: 2 Destination Ports: 5900, 5938 First Seen: 2026-06-08 00:35 UTC Last Seen: 2026-06-12 11:45 UTC show less	Brute-Force
🇵🇱 mkey	2026-06-12 06:05:05 (16 hours ago)	Source IP from blacklist is still actively scanning our network. (8 hits in last hour, last seen 202 ... show more Source IP from blacklist is still actively scanning our network. (8 hits in last hour, last seen 2026-06-12 07:40:52) show less	Port Scan
🇫🇮 Maxetow	2026-06-12 05:53:00 (17 hours ago)	Scan port: 5900 \| 4 total \| size=40B	Port Scan
🇦🇹 centurion	2026-06-12 05:10:44 (17 hours ago)	Blocked by UFW on cloud [5900/tcp] Source port: 53597 TTL: 246 Packet length: 40 TOS: 0x00 This rep ... show more Blocked by UFW on cloud [5900/tcp] Source port: 53597 TTL: 246 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇹🇷 SeczarSecureOps	2026-06-12 05:05:46 (17 hours ago)	Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — VNC (3 events in 1 ... show more Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — VNC (3 events in 10min) at 2026-06-12 05:05 show less	Web App Attack

Showing 1 to 15 of 638 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 216.226.76.10

🇺🇸 216.25.89.102

🇺🇸 205.210.31.45

🇧🇷 189.91.78.62

🇮🇳 182.95.40.26

🇨🇳 120.48.148.35

🇨🇳 111.23.129.238

🇫🇷 54.38.109.115

🇸🇳 41.82.50.218

🇺🇸 207.90.244.19

🇧🇪 198.235.24.196

🇬🇧 195.206.182.219

🇺🇸 195.184.76.154

🇺🇸 195.184.76.146

🇫🇮 45.133.115.37

🇺🇸 2607:f8b0:4001:c61::120

🇪🇹 196.189.236.162

🇩🇪 194.88.98.109

🇬🇧 193.163.125.33

🇬🇧 193.163.125.5