This IP address has been reported a total of
42
times from
32 distinct
sources.
103.104.28.192 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 3
reports;
France
with 3
reports;
United States of America
with 3
reports.
The most common categories in these recent reports were:
Bad Web Bot
5
times;
Hacking
3
times;
DDoS Attack
3
times;
Brute-Force
2
times;
Exploited Host
2
times;
Other
5
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
(modsec_5040) ModSec 5040: API Basic Auth blocked from 103.104.28.192 (NP/Nepal/cgnat-103-104-28-192 ...
show more(modsec_5040) ModSec 5040: API Basic Auth blocked from 103.104.28.192 (NP/Nepal/cgnat-103-104-28-192.firstlink.net.np): 1 in the last 3600 secs (0-195)
show less
Not following 301 redirects โ wasted requests | method: GET | path: /wenes-group-certifie-ecovadis-b ...
show moreNot following 301 redirects โ wasted requests | method: GET | path: /wenes-group-certifie-ecovadis-bronze-demarche-rse | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
show less
Bad Web Bot
Anonymous
denied traffic to a honeypot network. destination port 57616.
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ...
show moreMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
show less
UDP flood (DDoS) vs AS215599: 1238 pkts / 1.77 MB to UDP 80/8443 across 530 dst IP(s), 2026-08-19 21 ...
show moreUDP flood (DDoS) vs AS215599: 1238 pkts / 1.77 MB to UDP 80/8443 across 530 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
UDP flood (DDoS) vs AS215599: 1238 pkts / 1.77 MB to UDP 80/8443 across 530 dst IP(s), 2026-08-19 21 ...
show moreUDP flood (DDoS) vs AS215599: 1238 pkts / 1.77 MB to UDP 80/8443 across 530 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
Anonymous
Large-scale coordinated botnet (1.2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a ...
show moreLarge-scale coordinated botnet (1.2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/add/product/11594/form_key/PYvcMc782Ec258aH/ | UA: Mozilla/5.0 (compatible; MSIE 9.0; Windows 98; Trident/3.0) | (Magento Site)
show less
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being ...
show moreBnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap despite it clearly being a burning bag of dog poop.
103.104.28.192 443 - [30/Jul/2026:10:56:07 +0000] "GET [redacted] HTTP/1.1" 200 6301 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0"
show less
Blocked by UFW on amperetwo [23/tcp]
Source port: 52837
TTL: 52
Packet length: 60
TOS: 0x00
This re ...
show moreBlocked by UFW on amperetwo [23/tcp]
Source port: 52837
TTL: 52
Packet length: 60
TOS: 0x00
This report was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
2026-07-20T04:52:46 103.104.28.192 GET /Photos/Outdoors/2013-11-17%20Sonoma/raw/IMG_5861.CR2 Mozilla ...
show more2026-07-20T04:52:46 103.104.28.192 GET /Photos/Outdoors/2013-11-17%20Sonoma/raw/IMG_5861.CR2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
...
show less
