This IP address has been reported a total of
27,350
times from
2,535 distinct
sources.
104.28.201.73 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 683
reports;
United States of America
with 510
reports;
France
with 237
reports.
The most common categories in these recent reports were:
Brute-Force
2355
times;
SSH
2202
times;
Web App Attack
388
times;
Hacking
196
times;
Bad Web Bot
118
times;
Other
202
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show moreAutomated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.teddypot.website | URI: /.env.backup | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"104.28.201.73","Cdn-Loop":"cloudflare; loops=1","Sec-Ch-Ua":"\"Google Chrome\";v=\"135\", \"Chromium\";v=\"135\", \"Not.A\/Brand\";v=\"24\"","Accept-Enco
show less
Bad Web Bot
Web App Attack
Anonymous
2026-10-20T10:14:10.071351+01:00 [redacted] sshd[2924659]: Invalid user sc from 104.28.201.73 port 1 ...
show more2026-10-20T10:14:10.071351+01:00 [redacted] sshd[2924659]: Invalid user sc from 104.28.201.73 port 19836
2026-10-20T10:14:10.240586+01:00 [redacted] sshd[2924659]: Disconnected from invalid user sc 104.28.201.73 port 19836 [preauth]
show less
2026-10-25T16:34:37.201871+02:00 canterlot.jotoma.de sshd[581889]: Disconnected from authenticating ...
show more2026-10-25T16:34:37.201871+02:00 canterlot.jotoma.de sshd[581889]: Disconnected from authenticating user root 104.28.201.73 port 30892 [preauth]
2026-10-25T16:42:39.427388+02:00 canterlot.jotoma.de sshd[589417]: Disconnected from authenticating user root 104.28.201.73 port 40406 [preauth]
2026-10-25T16:45:00.307662+02:00 canterlot.jotoma.de sshd[591586]: Invalid user user01 from 104.28.201.73 port 50562
...
show less
[SunOct2515:15:59.2388072026][security2:error][pid632578:tid632607][client104.28.201.73:0]ModSecurit ...
show more[SunOct2515:15:59.2388072026][security2:error][pid632578:tid632607][client104.28.201.73:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"total360.ch.81-17-25-250.cpanel.site\"][uri\"/wp-config.php.bak\"][unique_id\"at4PH7qGUiEu-EUKk4dLUgAAABQ\"]
show less
Oct 25 14:04:22 znc sshd[880349]: Invalid user botuser from 104.28.201.73 port 20832
Oct 25 14:14:22 ...
show moreOct 25 14:04:22 znc sshd[880349]: Invalid user botuser from 104.28.201.73 port 20832
Oct 25 14:14:22 znc sshd[880491]: Invalid user server from 104.28.201.73 port 28736
...
show less
Report 2773643 with IP 824173 for SSH brute-force attack by source 2788538 via ssh-honeypot/0.2.1+ht ...
show moreReport 2773643 with IP 824173 for SSH brute-force attack by source 2788538 via ssh-honeypot/0.2.1+http
show less
Oct 25 14:31:55 proxy sshd[238239]: User root from 104.28.201.73 not allowed because not listed in A ...
show moreOct 25 14:31:55 proxy sshd[238239]: User root from 104.28.201.73 not allowed because not listed in AllowUsers
Oct 25 14:40:09 proxy sshd[238437]: User root from 104.28.201.73 not allowed because not listed in AllowUsers
Oct 25 14:42:33 proxy sshd[238474]: User root from 104.28.201.73 not allowed because not listed in AllowUsers
...
show less
[bas-9] SSH brute-force: 6 failed sshd authentication attempt(s) from 104.28.201.73 on port 22 (auto ...
show more[bas-9] SSH brute-force: 6 failed sshd authentication attempt(s) from 104.28.201.73 on port 22 (automated sensor)
show less
