This IP address has been reported a total of
101
times from
58 distinct
sources.
104.28.225.189 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 18
reports;
Indonesia
with 18
reports;
Italy
with 10
reports.
The most common categories in these recent reports were:
Brute-Force
68
times;
Web App Attack
16
times;
Port Scan
14
times;
Hacking
11
times;
Bad Web Bot
7
times;
Other
22
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show moreDetected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: 142.251.155.119:443
show less
Oct 7 22:31:22 canopus postfix/smtpd[3767034]: NOQUEUE: reject: RCPT from unknown[104.28.225.189]: ...
show moreOct 7 22:31:22 canopus postfix/smtpd[3767034]: NOQUEUE: reject: RCPT from unknown[104.28.225.189]: 554 5.7.1 Service unavailable; Client host [104.28.225.189] blocked using zen.spamhaus.org; Listed by CSS, see https://check.spamhaus.org/query/ip/104.28.225.189 / Listed by XBL, see https://check.spamhaus.org/query/ip/104.28.225.189; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<103.88.234.239>
Oct 8 00:01:38 canopus postfix/smtpd[3773012]: NOQUEUE: reject: RCPT from unknown[104.28.225.189]: 554 5.7.1 Service unavailable; Client host [104.28.225.189] blocked using zen.spamhaus.org; Listed by CSS, see https://check.spamhaus.org/query/ip/104.28.225.189 / Listed by XBL, see https://check.spamhaus.org/query/ip/104.28.225.189; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<103.88.234.239>
Oct 8 03:10:24 canopus postfix/smtpd[3794071]: NOQUEUE: reject: RCPT from unknown[104.28.225.189]: 554 5.7.1 Service unavailable; Client host [
...
show less
Honeypot trap triggered: unsolicited TCP connection(s) to unused port(s) 23 on a host running no suc ...
show moreHoneypot trap triggered: unsolicited TCP connection(s) to unused port(s) 23 on a host running no such service. There is no legitimate reason to connect to these ports.
Observed 1 connection(s) from 2026-10-04T20:32:22Z to 2026-10-04T20:32:22Z UTC.
2026-10-04T20:32:22Z tcp/23 data: GET / HTTP/1.1 Accept-Encoding: gzip, deflate, br Accept-L...
Connection was blocked automatically at the firewall. Reported by an automated honeypot.
show less
03 Oct 2026 16:08:42UTC:Distributed Brute Force Password Attack (smtp, ftp, imap, pop, ssh) includin ...
show more03 Oct 2026 16:08:42UTC:Distributed Brute Force Password Attack (smtp, ftp, imap, pop, ssh) including ip address 104.28.225.189
show less
