AbuseIPDB » 104.28.201.73

104.28.201.73 was found in our database!

This IP was reported 23,721 times. Confidence of Abuse is 100%: ?

100%

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 104.28.201.73

Whois 104.28.201.73

IP Abuse Reports for 104.28.201.73:

This IP address has been reported a total of 23,721 times from 1,876 distinct sources. 104.28.201.73 was first reported on July 19th 2022, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
zwh	2025-06-13 17:53:09 (5 hours ago)	SSH Brute-Force	Brute-Force SSH
ipblock.com	2025-06-13 04:04:00 (19 hours ago)	IPBlock protected site ID [1887-mw]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
vestibtech	2025-06-13 00:36:14 (23 hours ago)	104.28.201.73 - - [12/Jun/2025:18:36:14 -0600] "GET /xmlrpc.php HTTP/1.1" 404 10363 "-" "Mozilla/5.0 ... show more104.28.201.73 - - [12/Jun/2025:18:36:14 -0600] "GET /xmlrpc.php HTTP/1.1" 404 10363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
mnsf	2025-06-12 21:05:11 (1 day ago)	Too many Status 40X (12)	Brute-Force Web App Attack
rtbh.com.tr	2025-06-12 20:07:07 (1 day ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
mind5t0rm	2025-06-12 14:37:44 (1 day ago)	(XMLRPC,WPLOGIN) Login failure/trigger from 104.28.201.73 (US/United States/-): 3 in the last 3600 s ... show more(XMLRPC,WPLOGIN) Login failure/trigger from 104.28.201.73 (US/United States/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 104.28.201.73 - - [12/Jun/2025:21:37:32 +0700] "GET /xmlrpc.php HTTP/1.1" 405 53 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 104.28.201.73 - - [12/Jun/2025:21:37:34 +0700] "GET /wp-login.php HTTP/1.1" 200 3075 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 104.28.201.73 - - [12/Jun/2025:21:37:43 +0700] "POST /xmlrpc.php HTTP/1.1" 200 270 "https://www.bikehotels.travel/xmlrpc.php" "python-requests/2.21.0" show less	Port Scan
ipblock.com	2025-06-12 13:57:00 (1 day ago)	IPBlock protected site ID [1365-l]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
ipblock.com	2025-06-12 11:35:00 (1 day ago)	IPBlock protected site ID [1365-l]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
ipblock.com	2025-06-12 10:12:00 (1 day ago)	IPBlock protected site ID [1365-l]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
Jason Howell	2025-06-12 08:50:50 (1 day ago)	104.28.201.73 - - [12/Jun/2025:03:50:40 -0500] "GET /xmlrpc.php HTTP/1.1" 405 2915 "-" "Mozilla/5.0 ... show more104.28.201.73 - - [12/Jun/2025:03:50:40 -0500] "GET /xmlrpc.php HTTP/1.1" 405 2915 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 104.28.201.73 - - [12/Jun/2025:03:50:40 -0500] "GET /wp-login.php HTTP/1.1" 200 1707 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 104.28.201.73 - - [12/Jun/2025:03:50:41 -0500] "POST /xmlrpc.php HTTP/1.1" 200 3060 "https://www.ponderosamobilehomepark.com/xmlrpc.php" "python-requests/2.21.0" 104.28.201.73 - - [12/Jun/2025:03:50:41 -0500] "POST /xmlrpc.php HTTP/1.1" 200 3059 "https://www.ponderosamobilehomepark.com/xmlrpc.php" "python-requests/2.21.0" 104.28.201.73 - - [12/Jun/2025:03:50:45 -0500] "POST /xmlrpc.php HTTP/1.1" 200 3060 "https://www.ponderosamobilehomepark.com/xmlrpc.php" "python-requests/2.21.0" ... show less	Web App Attack
Singha58	2025-06-12 07:30:51 (1 day ago)	2025-06-12T09:22:32.618909+02:00 v220240537442267460 sshd[716917]: Failed password for invalid user ... show more2025-06-12T09:22:32.618909+02:00 v220240537442267460 sshd[716917]: Failed password for invalid user copia from 104.28.201.73 port 56945 ssh2 2025-06-12T09:29:17.437420+02:00 v220240537442267460 sshd[717584]: Invalid user pre from 104.28.201.73 port 42169 2025-06-12T09:29:17.439649+02:00 v220240537442267460 sshd[717584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.73 2025-06-12T09:29:18.837556+02:00 v220240537442267460 sshd[717584]: Failed password for invalid user pre from 104.28.201.73 port 42169 ssh2 2025-06-12T09:30:51.351356+02:00 v220240537442267460 sshd[717687]: Invalid user mysql from 104.28.201.73 port 46769 ... show less	Brute-Force SSH
dbm webdesign	2025-06-12 07:30:49 (1 day ago)	Jun 12 09:29:14 monitoring sshd[3075433]: Invalid user pre from 104.28.201.73 port 38359 Jun 1 ... show moreJun 12 09:29:14 monitoring sshd[3075433]: Invalid user pre from 104.28.201.73 port 38359 Jun 12 09:29:14 monitoring sshd[3075433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.73 Jun 12 09:29:14 monitoring sshd[3075433]: Invalid user pre from 104.28.201.73 port 38359 Jun 12 09:29:16 monitoring sshd[3075433]: Failed password for invalid user pre from 104.28.201.73 port 38359 ssh2 Jun 12 09:30:49 monitoring sshd[3075551]: Invalid user mysql from 104.28.201.73 port 28539 ... show less	Brute-Force SSH
trivox.sh	2025-06-12 07:28:11 (1 day ago)	Jun 12 07:24:20 honey3 sshd[1905730]: Failed password for invalid user copia from 104.28.201.73 port ... show moreJun 12 07:24:20 honey3 sshd[1905730]: Failed password for invalid user copia from 104.28.201.73 port 16109 ssh2 Jun 12 07:24:20 honey3 sshd[1905730]: Disconnected from invalid user copia 104.28.201.73 port 16109 [preauth] Jun 12 07:28:08 honey3 sshd[1906038]: Invalid user ubuntu from 104.28.201.73 port 30678 Jun 12 07:28:08 honey3 sshd[1906038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.73 Jun 12 07:28:11 honey3 sshd[1906038]: Failed password for invalid user ubuntu from 104.28.201.73 port 30678 ssh2 ... show less	Brute-Force SSH
Woodie	2025-06-12 06:49:25 (1 day ago)	2025-06-12T02:46:07.907202-04:00 debian sshd[3921787]: pam_unix(sshd:auth): authentication failure; ... show more2025-06-12T02:46:07.907202-04:00 debian sshd[3921787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.73 2025-06-12T02:46:09.410443-04:00 debian sshd[3921787]: Failed password for invalid user ram from 104.28.201.73 port 51616 ssh2 2025-06-12T02:49:23.704552-04:00 debian sshd[3925204]: Invalid user hamed from 104.28.201.73 port 63278 2025-06-12T02:49:23.708050-04:00 debian sshd[3925204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.73 2025-06-12T02:49:25.451164-04:00 debian sshd[3925204]: Failed password for invalid user hamed from 104.28.201.73 port 63278 ssh2 ... show less	Brute-Force SSH
Max la Menace	2025-06-12 06:32:52 (1 day ago)	ssh brute force (P)	Brute-Force SSH

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩