JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.201.78

Neutral Activity

Abuse Confidence Score

0% Low Risk

56 reports

32 reporters · latest 2 months ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇺🇸 United States of America
City: San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

104.28.201.78 has been reported 56 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

56 from 32 distinct reporters

First reported

January 25th 2023

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 URAN Publishing Service	2026-08-29 06:38:42 UTC · (2 months ago)	[29/Aug/2026:09:38:42 +0300] -- 104.28.201.78 Ban reason: User-Agent curl/	Bad Web Bot Web App Attack
🇺🇸 xxkodedxx	2026-07-24 00:34:16 UTC · (3 months ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10m window. Origin: LR / AS13335 Cloudflare, Inc. Active: 00:33:21 UTC Volume: 1 HTTP req Probed: /aZ9xQ7kL3m Status mix: 444×1 Vhost fishing: cards.zvx ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10m window. Origin: LR / AS13335 Cloudflare, Inc. Active: 00:33:21 UTC Volume: 1 HTTP req Probed: /aZ9xQ7kL3m Status mix: 444×1 Vhost fishing: cards.zvxlabs.com UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇺🇸 lnklnx	2026-07-23 08:54:51 UTC · (3 months ago)	www.lincolnclan.com:443 104.28.201.78 - - [23/Jul/2026:03:35:49 -0500] "GET /.env.test HTTP/1.1" 401 5580 "https://www.google.com/search?q=www.lincolnclan.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Ver ... show more www.lincolnclan.com:443 104.28.201.78 - - [23/Jul/2026:03:35:49 -0500] "GET /.env.test HTTP/1.1" 401 5580 "https://www.google.com/search?q=www.lincolnclan.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" ... show less	Web App Attack
🇺🇦 URAN Publishing Service	2026-07-18 14:55:32 UTC · (3 months ago)	Bad Web Bot	DDoS Attack Bad Web Bot
🇫🇷 masterguru	2026-04-15 03:27:49 UTC · (6 months ago)	(modsec_5001) ModSec 5001: Backdoor 266BC0C from 104.28.201.78 (LR/Liberia/-): 1 in the last 3600 secs (0-196)	Hacking
Anonymous	2026-04-11 16:31:09 UTC · (6 months ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇮🇹 VHosting	2026-04-06 22:23:36 UTC · (7 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇫🇷 bigorre.org	2026-01-13 13:22:05 UTC · (9 months ago)	Excessive crawling : exceed crawl-delay defined in robots.txt	Bad Web Bot
Anonymous	2025-12-23 19:31:19 UTC · (10 months ago)	Fail2Ban SSH login block from 104.28.201.78	SSH
🇩🇪 Packets-Decreaser.NET	2025-12-19 05:34:48 UTC · (10 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇮🇹 VHosting	2025-12-14 15:09:21 UTC · (10 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇨🇳 ThreatBook.io	2025-07-25 22:58:00 UTC · (1 year ago)	2025-07-25 15:19:12 /cc.gif 2025-07-25 15:19:23 /cc.gif	Web App Attack
🇺🇸 tradenet	2023-04-07 17:54:17 UTC · (3 years ago)	2023-04-07T12:39:44.132505server2.ebullit.com sshd[7152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.78 user=root 2023-04-07T12:39:46.266693server2.ebullit.com sshd[7152]: Failed password for r ... show more 2023-04-07T12:39:44.132505server2.ebullit.com sshd[7152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.78 user=root 2023-04-07T12:39:46.266693server2.ebullit.com sshd[7152]: Failed password for root from 104.28.201.78 port 55958 ssh2 2023-04-07T12:54:13.980569server2.ebullit.com sshd[11576]: Invalid user user from 104.28.201.78 port 15208 2023-04-07T12:54:13.985056server2.ebullit.com sshd[11576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.78 2023-04-07T12:54:16.420410server2.ebullit.com sshd[11576]: Failed password for invalid user user from 104.28.201.78 port 15208 ssh2 ... show less	Brute-Force SSH
🇺🇸 Nazgul	2023-04-07 17:32:36 UTC · (3 years ago)	SSH brute force attempt (f4)	Brute-Force SSH
🇺🇸 bigscoots.com	2023-04-07 15:38:37 UTC · (3 years ago)	104.28.201.78 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_DISTATTACK; Logs: Apr 7 10:27:21 13542 sshd[6063]: pam_unix(sshd:auth): authentication failure; logname= uid= ... show more 104.28.201.78 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_DISTATTACK; Logs: Apr 7 10:27:21 13542 sshd[6063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.78 user=root Apr 7 10:27:22 13542 sshd[6063]: Failed password for root from 104.28.201.78 port 9776 ssh2 Apr 7 10:38:17 13542 sshd[6875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.201.76 user=root Apr 7 10:25:30 13542 sshd[5934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.28.233.77 user=root Apr 7 10:25:32 13542 sshd[5934]: Failed password for root from 104.28.233.77 port 43294 ssh2 IP Addresses Blocked: show less	Brute-Force SSH

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇪 207.175.218.17

🇰🇷 118.37.214.187

🇨🇳 113.31.111.108

🇮🇳 103.171.53.34

🇯🇵 52.192.76.61

🇬🇧 35.203.210.68

🇨🇱 34.176.246.126

🇺🇸 34.125.240.193

🇧🇪 34.38.88.176

🇰🇷 218.152.91.214

🇨🇳 218.78.186.58

🇲🇦 196.92.7.249

🇳🇱 195.178.110.31

🇳🇱 195.178.110.26

🇸🇦 188.54.227.65

🇳🇱 185.136.15.17

🇷🇺 154.83.196.237

🇺🇸 98.116.82.213

🇧🇬 79.124.56.254

🇳🇱 77.239.124.121