JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.216.172

Activity Trending Down

Abuse Confidence Score

31% Elevated

30 reports

20 reporters · latest 1 week ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇹🇷 Turkey
City: Ankara, Ankara

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

30 from 20 distinct reporters

First reported

July 31st 2022

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇨🇭 Switzerland 2 🇦🇺 Australia 1 🇩🇪 Germany 1

Most common categories Brute-Force 2 Web App Attack 2 SQL Injection 1 Port Scan 1 Bad Web Bot 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 backslash	2026-10-30 22:57:00 UTC · (1 week ago)	block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638	Bad Web Bot
🇦🇺 oncord	2026-10-30 19:15:19 UTC · (1 week ago)	Form spam	Web Spam
🇺🇸 IndigoRidge	2026-10-25 16:54:29 UTC · (2 weeks ago)	104.28.216.172 - - [25/Oct/2026:12:52:30 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5231 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/91.0.0.0 Safari/537.36" 104.28.216.172 - - [25/Oct/2026:12:53:02 -0400] "POST /xml ... show more 104.28.216.172 - - [25/Oct/2026:12:52:30 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5231 "-" "Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/91.0.0.0 Safari/537.36" 104.28.216.172 - - [25/Oct/2026:12:53:02 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5231 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36" 104.28.216.172 - - [25/Oct/2026:12:53:29 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5231 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/90.0.0.0 Safari/537.36" 104.28.216.172 - - [25/Oct/2026:12:53:59 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5231 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36" 104.28.216.172 - - [25/Oct/2026:12:54:27 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5231 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.0 ... show less	Web App Attack
🇱🇹 Evag Touf	2026-10-15 21:28:33 UTC · (3 weeks ago)	(mod_security) mod_security triggered on hostname [redacted] 104.28.216.172 (TR/Türkiye/-)	SQL Injection
🇯🇵 rafale2k	2026-10-13 15:53:39 UTC · (4 weeks ago)	WordPress Brute Force	Brute-Force Web App Attack
🇨🇭 SnapDragon	2026-10-10 11:55:00 UTC · (1 month ago)	Failed to log in via user account "admin". Source IP address: 104.28.216.172	Brute-Force
Anonymous	2026-10-10 10:30:58 UTC · (1 month ago)	denied traffic to a non-approved destination port. destination port 62341.	Port Scan
Anonymous	2026-09-07 02:20:51 UTC · (2 months ago)	Web attack	Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-09-01 13:58:37 UTC · (2 months ago)	[01/Sep/2026:16:58:36 +0300] -- 104.28.216.172 Ban reason: User-Agent Python-urllib	Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-08-22 10:09:38 UTC · (2 months ago)	Blocked by UFW (TCP on 48281) Source port: 36090 TTL: 46 Packet length: 60 TOS: 0x08 This report (for 104.28.216.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇺🇸 IndigoRidge	2026-08-18 10:58:13 UTC · (2 months ago)	104.28.216.172 - - [18/Aug/2026:06:55:12 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress.com" 104.28.216.172 - - [18/Aug/2026:06:56:16 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress ... show more 104.28.216.172 - - [18/Aug/2026:06:55:12 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress.com" 104.28.216.172 - - [18/Aug/2026:06:56:16 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress.com" 104.28.216.172 - - [18/Aug/2026:06:56:26 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress.com" 104.28.216.172 - - [18/Aug/2026:06:56:37 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress.com" 104.28.216.172 - - [18/Aug/2026:06:58:12 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "WordPress.com; https://wordpress.com" ... show less	Web App Attack
🇧🇪 madeit	2026-08-17 19:31:50 UTC · (2 months ago)		Web App Attack
🇩🇪 HandyTreff.de	2026-07-05 22:45:51 UTC · (4 months ago)	Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -32.808 (Bad < -10 / Very Bad < -20 / Extreme < -35) \| UA: Mozilla/5.0 (Linux; Android 14; Pixel 6 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.626	Web App Attack Bad Web Bot
🇺🇸 xmission.com	2025-12-04 21:10:44 UTC · (11 months ago)	Blocked by UFW (TCP on 9101) Source port: 21323 TTL: 44 Packet length: 60 TOS: 0x08 This report (for 104.28.216.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
Anonymous	2025-08-04 16:44:30 UTC · (1 year ago)	wordpress-trap	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 200.138.46.183

🇦🇷 200.107.89.8

🇨🇳 118.196.86.3

🇧🇩 103.159.2.113

🇷🇴 2.57.121.25

🇵🇭 180.190.85.177

🇨🇳 140.75.103.183

🇺🇸 138.68.10.54

🇧🇷 131.72.191.212

🇰🇷 121.179.93.147

🇨🇳 101.227.49.193

🇺🇸 98.175.205.145

🇺🇸 184.105.247.202

🇺🇸 184.72.198.10

🇨🇳 124.90.52.137

🇨🇳 123.180.188.162

🇰🇪 102.210.148.41

🇫🇷 91.196.152.99

🇳🇵 202.70.73.78

🇨🇱 201.148.107.89