JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.28.196.77

104.28.196.77 was found in our database!

This IP was reported 13,160 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Washington, District of Columbia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.28.196.77

Whois 104.28.196.77

IP Abuse Reports for 104.28.196.77:

This IP address has been reported a total of 13,160 times from 1,580 distinct sources. 104.28.196.77 was first reported on September 13th 2022, and the most recent report was 18 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 abuseiphack	2026-10-27 01:31:12 (18 minutes ago)	Automatic report for brute force attack	Bad Web Bot
🇫🇷 dwmp	2026-10-27 00:58:03 (51 minutes ago)	[27/Oct/2026:01:58:01.828853 +0100] at_3GYu60rwFt9mjz6VAagAAAIE 104.28.196.77 49792 38.242.227.117 7 ... show more [27/Oct/2026:01:58:01.828853 +0100] at_3GYu60rwFt9mjz6VAagAAAIE 104.28.196.77 49792 38.242.227.117 7081 [27/Oct/2026:01:58:01.834782 +0100] at_3GYu60rwFt9mjz6VAawAAAJI 104.28.196.77 49784 38.242.227.117 7081 [27/Oct/2026:01:58:01.841993 +0100] at_3GYu60rwFt9mjz6VAbQAAAJE 104.28.196.77 49814 38.242.227.117 7081 ... show less	Brute-Force SSH
🇵🇱 Budyn	2026-10-27 00:57:23 (52 minutes ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: db.goblinpot.online \| URI: /.env.local \| UA: Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36 \| BODY: [Empty / GET Request] \| HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"104.28.196.77","Cdn-Loop":"cloudflare; loops=1","Accept-Encoding":"gzip, br","Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,\/;q=0 show less	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-10-27 00:20:34 (1 hour ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 on-com	2026-10-27 00:09:27 (1 hour ago)	URL scan	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-10-26 23:58:48 (1 hour ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-10-26 23:39:58 (2 hours ago)	104.28.196.77 - - [26/Oct/2026:23:39:55 +0000] "GET /.env.backup HTTP/1.1" 401 17 "-" "-" 260827 "co ... show more 104.28.196.77 - - [26/Oct/2026:23:39:55 +0000] "GET /.env.backup HTTP/1.1" 401 17 "-" "-" 260827 "cockpit-router@file" "-" 0ms 104.28.196.77 - - [26/Oct/2026:23:39:57 +0000] "GET /wp-config.php.bak HTTP/1.1" 401 17 "-" "-" 260838 "cockpit-router@file" "-" 0ms ... show less	Web App Attack
🇫🇷 SpaceHost-Server	2026-10-26 23:14:43 (2 hours ago)		Brute-Force Web App Attack
Anonymous	2026-10-26 22:05:10 (3 hours ago)	sensitive path probe detected by fail2ban ...	Port Scan Web App Attack
🇸🇬 anotherwatcher	2026-10-26 22:01:15 (3 hours ago)	bad bot	Bad Web Bot
🇩🇪 snhosting	2026-10-26 21:44:30 (4 hours ago)	104.28.196.77 - - [26/Oct/2026:22:43:56 +0100] "GET /.git/HEAD HTTP/1.1" 422 496 "-" "Mozilla/5.0 (M ... show more 104.28.196.77 - - [26/Oct/2026:22:43:56 +0100] "GET /.git/HEAD HTTP/1.1" 422 496 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 104.28.196.77 - - [26/Oct/2026:22:43:59 +0100] "GET /wp-config.php.bak HTTP/1.1" 404 844 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 104.28.196.77 - - [26/Oct/2026:22:43:59 +0100] "GET /.aws/credentials HTTP/1.1" 422 496 "https://www.google.com/search?q=btw.snsolution.de" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 104.28.196.77 - - [26/Oct/2026:22:44:02 +0100] "GET /.env.save HTTP/1.1" 422 496 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" 104.28.196.77 - - [26/Oct/2026:22:44:05 +0100] "GET /.env.development.local HTTP/1.1" 422 496 "https://www.google.com/search?q=bt ... show less	DNS Compromise DNS Poisoning Phishing Email Spam Brute-Force Web App Attack SSH
Anonymous	2026-10-26 21:31:47 (4 hours ago)	104.28.196.77 - - [27/Oct/2026:05:31:46 +0800] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Window ... show more 104.28.196.77 - - [27/Oct/2026:05:31:46 +0800] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-26 21:29:38 (4 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.definitelynotahoneypot.online \| URI: /.env.production \| UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot) \| BODY: [Empty / GET Request] \| HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"104.28.196.77","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a50c8ebb6816d688-IAD","Accept-Language":"en-US,en;q=0.9","Accep show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-26 21:08:12 (4 hours ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104 ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.196.77 - - [22/Oct/2026:18:01:20 +0200] "GET /.aws/credentials HTTP/1.1" 404 5943 "http://www.bouwgroepzuiderbosch.nl/.aws/credentials" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 macrob	2026-10-26 20:46:12 (5 hours ago)	2026/10/26 20:46:09 [error] 2286328#2286328: 13932316 access forbidden by rule, client: 104.28.196. ... show more 2026/10/26 20:46:09 [error] 2286328#2286328: 13932316 access forbidden by rule, client: 104.28.196.77, server: binixo.com.ua, request: "GET /.env.backup HTTP/1.1", host: "binixo.com.ua" 2026/10/26 20:46:09 [error] 2286328#2286328: 13932312 access forbidden by rule, client: 104.28.196.77, server: binixo.com.ua, request: "GET /.env.local HTTP/1.1", host: "binixo.com.ua" 2026/10/26 20:46:10 [error] 2286324#2286324: 13932355 access forbidden by rule, client: 104.28.196.77, server: binixo.es, request: "GET /.env HTTP/1.1", host: "binixo.es" ... show less	Web App Attack

Showing 1 to 15 of 13160 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 178.104.4.242

🇳🇱 176.65.149.4

🇺🇸 162.214.124.247

🇺🇸 20.228.168.74

🇵🇰 203.128.253.53

🇳🇱 200.138.46.126

🇧🇪 198.235.24.214

🇸🇴 192.145.169.66

🇵🇹 188.83.214.39

🇬🇹 181.209.186.93

🇳🇱 160.119.76.142

🇺🇸 129.121.115.119

🇨🇳 124.221.221.221

🇹🇭 110.49.76.244

🇧🇩 103.23.95.99

🇫🇷 91.196.152.193

🇧🇬 79.124.49.82

🇸🇬 47.128.120.227

🇺🇸 45.41.86.226

🇺🇸 40.124.187.33