JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.86.202.28

45.86.202.28 was found in our database!

This IP was reported 253 times. Confidence of Abuse is 39%: ?

39%

ISP	VPN Consumer Frankfurt, Germany
Usage Type	Data Center/Web Hosting/Transit
ASN	AS206092
Domain Name	vpnconsumer.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.86.202.28

Whois 45.86.202.28

IP Abuse Reports for 45.86.202.28:

This IP address has been reported a total of 253 times from 102 distinct sources. 45.86.202.28 was first reported on October 25th 2021, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 EvilTurkey	2026-08-21 13:22:07 (4 hours ago)	Web app attack against financial institution website.	Web App Attack Hacking
🇹🇷 neron	2026-08-12 13:06:48 (1 week ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-08-11 13:06:48 (1 week ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-11 09:00:53 (1 week ago)	Zimbra: Login failures from malicious IP: 45.86.202.28. Threat Score: 6.8/10 (HIGH). Confidence: 40% ... show more Zimbra: Login failures from malicious IP: 45.86.202.28. Threat Score: 6.8/10 (HIGH). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 94%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-11 07:00:53 (1 week ago)	Zimbra: Login failures from malicious IP: 45.86.202.28. Threat Score: 6.7/10 (HIGH). Confidence: 40% ... show more Zimbra: Login failures from malicious IP: 45.86.202.28. Threat Score: 6.7/10 (HIGH). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 94%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-11 06:00:09 (1 week ago)	Zimbra: Login failures from malicious IP: 45.86.202.28. Threat Score: 6/10 (MEDIUM). Reported by Tan ... show more Zimbra: Login failures from malicious IP: 45.86.202.28. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇹🇷 neron	2026-07-29 20:19:38 (3 weeks ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-28 14:19:38 (3 weeks ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇬🇧 consul.to	2026-07-21 17:34:20 (4 weeks ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-07-20 21:40:30 (1 month ago)	Multiple, malicious web requests detected	Port Scan Hacking
🇳🇱 0xffffffff	2026-07-20 20:05:17 (1 month ago)	[2026-07-20 23:05:14.296064] [authz_core:error] [pid 624773:tid 124364124395200] [client 45.86.202.2 ... show more [2026-07-20 23:05:14.296064] [authz_core:error] [pid 624773:tid 124364124395200] [client 45.86.202.28:0] AH01630: client denied by server configuration: /var/www//wp-includes/woocommerce-call.php, referer http:///wp-includes/woocommerce-call.php , error_notes:wp:include-files , URI:'/wp-includes/woocommerce-call.php' [2026-07-20 23:05:14.568737] [authz_core:error] [pid 624774:tid 124364057122496] [client 45.86.202.28:0] AH01630: client denied by server configuration: /var/www//wp-content/plugins/wordpress-seo, referer http:///wp-content/plugins/wordpress-seo/wp-seo-main-float.php , error_notes:wp:include-files , URI:'/wp-content/plugins/wordpress-seo/wp-seo-main-float.php' [2026-07-20 23:05:14.863387] [authz_core:error] [pid 624774:tid 124364099167936] [client 45.86.202.28:0] AH01630: client denied by server configuration: /var/www//wp-content/plugins/enhanced-text-widget, referer http:///wp-content/plugins/enhanced-text-widget/analyst/src/403x.php , error_notes:wp:include-files , URI:'/wp-content/plugi show less	Web App Attack Bad Web Bot
🇧🇷 ICS Labs	2026-07-10 18:33:11 (1 month ago)	ICS Labs identified 45.86.202.28 as a malicious indicator from threat intelligence.	DDoS Attack Port Scan Hacking Brute-Force Exploited Host
🇺🇸 TPI-Abuse	2026-07-09 16:09:05 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 45.86.202.28 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:240335) triggered by 45.86.202.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 12:08:57.839695 2026] [security2:error] [pid 12376:tid 12376] [client 45.86.202.28:46777] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 45.86.202.28 (+1 hits since last alert)\|unityhealthpharmaceutical.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "unityhealthpharmaceutical.com"] [uri "/xmlrpc.php"] [unique_id "ak_HmQgfMuejv84_G3GCqgAAAHU"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-07-09 15:52:09 (1 month ago)	trying wp-login.php/xmlrpc.php 84 times in 1 minutes	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-07-03 19:20:45 (1 month ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 253 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 178.208.125.20

🇩🇪 167.94.146.48

🇩🇪 162.62.223.77

🇵🇭 154.18.197.35

🇺🇸 147.182.228.12

🇨🇳 101.42.41.164

🇩🇪 51.75.146.215

🇺🇸 50.116.72.139

🇪🇸 46.253.45.10

🇳🇱 45.148.10.151

🇺🇸 207.90.244.26

🇨🇳 121.15.140.235

🇺🇸 45.156.129.65

🇨🇳 39.88.107.101

🇻🇳 1.53.84.222

🇺🇸 207.244.224.200

🇮🇷 185.7.172.105

🇦🇷 181.46.57.42

🇲🇾 47.250.87.56

🇺🇸 216.25.89.157