JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.196.191.57

Recent Activity

Abuse Confidence Score

61% Elevated

10 reports

10 reporters · latest 1 hour ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 57.191.196.104.bc.googleusercontent.com
Domain Name: google.com
Country: 🇺🇸 United States of America
City: North Charleston, South Carolina

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

10 from 10 distinct reporters

First reported

November 6th 2026

Most recent report

1 hour ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇩🇪 Germany 2 🇦🇷 Argentina 1

Most common categories Brute-Force 5 Web App Attack 4 Email Spam 2 Port Scan 2 SSH 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇰 floyd_dk	2026-11-06 10:14:44 UTC · (1 hour ago)	Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: HANGUP after 0 from [104.196.191.57]:34442 in tests before SMTP handshake Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: PREGREET 1023 after 0 from [104.196.191.57]:34460: \026\003\001\005\351\00 ... show more Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: HANGUP after 0 from [104.196.191.57]:34442 in tests before SMTP handshake Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: PREGREET 1023 after 0 from [104.196.191.57]:34460: \026\003\001\005\351\001\000\005\345\003\003\363\334\213\241rd\266\206\302\210SU\366h\305\222\005\21 Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: PREGREET 54 after 0 from [104.196.191.57]:34490: {"id": 1, "method": "mining.subscribe", "params": []}\n Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: PREGREET 215 after 0 from [104.196.191.57]:34456: GET / HTTP/1.1\r\nHost: jttarchive.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl Nov 06 10:14:44 smtp01 postfix/postscreen[183576]: PREGREET 32 after 0 from [104.196.191.57]:34450: \003\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000 ... show less	Email Spam Brute-Force
🇩🇪 london2038.com	2026-11-06 09:47:54 UTC · (1 hour ago)	Unsolicited connect to 2222/TCP 2026-11-06 10:47:52.755859933 +0100 CET, 104.196.191.57:55196, closing 2026-11-06 10:47:53.593779812 +0100 CET, 104.196.191.57:55202, closing	Port Scan SSH
🇺🇸 EiE-jp	2026-11-06 09:07:01 UTC · (2 hours ago)	Blocked by ECL FireGuard: 5 unauthorised connection attempts across 2 ports (2083/tcp, 2087/tcp) in 10m	Port Scan
🇧🇾 hbars.by	2026-11-06 08:36:05 UTC · (3 hours ago)	2026-11-06T11:36:04.424099+03:00 radionet dovecot: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.196.191.57, lip=192.168.3.3, TLS handshaking: Connection closed, session=<Mby2gJdf6O1oxL85> 2026-11-06T11:36 ... show more 2026-11-06T11:36:04.424099+03:00 radionet dovecot: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.196.191.57, lip=192.168.3.3, TLS handshaking: Connection closed, session=<Mby2gJdf6O1oxL85> 2026-11-06T11:36:04.664148+03:00 radionet dovecot: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:0A00010B:SSL routines::wrong version number (no auth attempts in 0 secs): user=<>, rip=104.196.191.57, lip=192.168.3.3, TLS handshaking: SSL_accept() failed: error:0A00010B:SSL routines::wrong version number, session=<uma6gJdf+O1oxL85> show less	Brute-Force
🇩🇪 jotoma.de	2026-11-06 08:25:04 UTC · (3 hours ago)	2026-11-06T09:25:02.497489+01:00 canterlot.jotoma.de sshd[3997571]: banner exchange: Connection from 104.196.191.57 port 50934: invalid format 2026-11-06T09:25:02.535589+01:00 canterlot.jotoma.de sshd[3997589]: error: kex_exchange_identification: Con ... show more 2026-11-06T09:25:02.497489+01:00 canterlot.jotoma.de sshd[3997571]: banner exchange: Connection from 104.196.191.57 port 50934: invalid format 2026-11-06T09:25:02.535589+01:00 canterlot.jotoma.de sshd[3997589]: error: kex_exchange_identification: Connection closed by remote host 2026-11-06T09:25:02.535633+01:00 canterlot.jotoma.de sshd[3997589]: Connection closed by 104.196.191.57 port 50984 ... show less	Brute-Force SSH
Anonymous	2026-11-06 08:23:34 UTC · (3 hours ago)	Postfix SMTP rejection	Email Spam
🇺🇸 kosada.com	2026-11-06 08:21:44 UTC · (3 hours ago)	Repeated requests with invalid HTTP method or version, for example: 104.196.191.57 - - [06/Nov/2026:03:21:44 -0500] "{ "id"": 1	Web App Attack
🇺🇸 mnsf	2026-11-06 08:05:21 UTC · (3 hours ago)	Too many Status 40X (13)	Brute-Force Web App Attack
🇮🇹 VHosting	2026-11-06 07:35:05 UTC · (4 hours ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇪🇸 robotstxt	2026-11-06 07:11:18 UTC · (4 hours ago)	104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 200 "-" "-" "-" 104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "PI ... show more 104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 200 "-" "-" "-" 104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "PING c504cd04-b8e2-43df-9e5d-02f89fe2e3b5" 400 200 "-" "-" "-" 104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "{\x22id\x22: 1, \x22method\x22: \x22mining.subscribe\x22, \x22params\x22: []}" 400 200 "-" "-" "-" 104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "\x16\x03\x01\x00\x80\x01\x00\x00\|\x03\x01\x92\x8D~Pm\x04\xC7\x8A.\x03}\x93\xC2\x04\x17\xB7*\x8D\xDD\xD2\xAD\xFE]\xDA[\xB56Vo\x05\xAE\xBA zt\xC9n\xE4\xF6\x8D\xE2I5i\xA0R\xC9\xFE<\x98\x1CszQz\x1A\x8Cw\x92\x01\x22H\x86\xFAJ\x00\x02\x005\x01\x00\x001\x00\x0B\x00\x02\x01\x00\xFF\x01\x00\x01\x00\x00\x17\x00\x00\x00\x12\x00\x00\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00" 400 200 "-" "-" "-" 104.196.191.57 - - [06/Nov/2026:07:11:17 +0000] "\x16\x03\x01\x05\xED\x01\x00\x05\xE9\x03\x03" 400 200 "-" " ... show less	Web Spam Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇷 177.104.131.33

🇫🇮 147.185.133.167

🇸🇬 136.85.44.68

🇨🇳 82.157.7.182

🇧🇬 79.124.49.90

🇺🇸 65.49.1.62

🇺🇸 52.248.42.247

🇬🇧 46.101.5.217

🇬🇧 35.203.210.4

🇵🇱 34.158.230.128

🇨🇳 1.95.142.34

🇳🇱 213.177.179.80

🇧🇷 200.181.223.89

🇧🇪 198.235.24.150

🇧🇷 186.205.19.118

🇺🇸 159.223.122.120

🇺🇸 148.153.189.62

🇺🇸 147.185.132.237

🇨🇦 144.217.61.131

🇺🇸 136.118.110.244