JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.28.196.79

Recent Activity

Abuse Confidence Score

100% Critical

600 reports

206 reporters · latest 55 minutes ago

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇺🇸 United States of America
City: Washington, District of Columbia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

600 from 206 distinct reporters

First reported

December 5th 2022

Most recent report

55 minutes ago

Last 60 days

Top reporter locations 🇵🇱 Poland 80 🇺🇸 United States of America 70 🇫🇷 France 32

Most common categories Web App Attack 275 Bad Web Bot 145 Hacking 80 Brute-Force 71 Port Scan 14

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-11-14 16:42:27 UTC · (55 minutes ago)	104.28.196.79 - - [15/Nov/2026:00:42:27 +0800] "GET /.env HTTP/1.1" 200 30682 "https://www.google.com/search?q=aywealthhk.com" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36 ... show more 104.28.196.79 - - [15/Nov/2026:00:42:27 +0800] "GET /.env HTTP/1.1" 200 30682 "https://www.google.com/search?q=aywealthhk.com" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 Optimatiq (ThreatBite)	2026-11-14 16:18:04 UTC · (1 hour ago)	Probe for secrets or exploit paths (fail2ban)	Hacking Web App Attack
🇵🇱 Budyn	2026-11-14 15:28:37 UTC · (2 hours ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: backup.definitelynotahoneypot.xyz \| Path: /.env.production \| User-Agent: Mozilla/5.0 (Windows ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: backup.definitelynotahoneypot.xyz \| Path: /.env.production \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
🇫🇷 ELYAZ	2026-11-14 14:02:30 UTC · (3 hours ago)	(credential-hunter) Failed credential-hunter trigger with match [redacted] from 104.28.196.79 (US/United States/-): (CF_ENABLE)	Hacking
🇺🇸 johnkarlhill	2026-11-14 13:05:07 UTC · (4 hours ago)	WebKnight blocked malicious web request on johnkarlhill.com	Brute-Force SSH
🇳🇱 WeCloudit-Anti-Abuse	2026-11-14 10:36:15 UTC · (7 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
Anonymous	2026-11-14 10:29:12 UTC · (7 hours ago)	104.28.196.79 - - [14/Nov/2026:03:26:04 -0600] "GET /.env.backup HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 172.71.190.31 104.28.196.79 - - [14/Nov/2 ... show more 104.28.196.79 - - [14/Nov/2026:03:26:04 -0600] "GET /.env.backup HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 172.71.190.31 104.28.196.79 - - [14/Nov/2026:03:26:04 -0600] "GET /.env.local HTTP/1.1" 403 10804 "https://www.google.com/search?q=my.brentwoodindustries.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 104.22.93.124 104.28.196.79 - - [14/Nov/2026:03:26:04 -0600] "GET /.env.production HTTP/1.1" 403 10804 "https://www.google.com/search?q=my.brentwoodindustries.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" 162.158.79.139 104.28.196.79 - - [14/Nov/2026:03:26:04 -0600] "GET /.env.save HTTP/1.1" 403 10804 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15" 104.22.104.196 104.28.196.79 - - [14/Nov/2026:03:26: ... show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-14 09:37:03 UTC · (8 hours ago)	IP matched detection query bad paths many.	Brute-Force Web App Attack
🇩🇪 macrob	2026-11-14 09:18:11 UTC · (8 hours ago)	2026/11/14 09:18:10 [error] 3997145#3997145: 4449458 access forbidden by rule, client: 104.28.196.79, server: binixo.com, request: "GET /.env.production HTTP/2.0", host: "binixo.com", referrer: "https://www.google.com/search?q=binixo.com" 2026/11/14 ... show more 2026/11/14 09:18:10 [error] 3997145#3997145: 4449458 access forbidden by rule, client: 104.28.196.79, server: binixo.com, request: "GET /.env.production HTTP/2.0", host: "binixo.com", referrer: "https://www.google.com/search?q=binixo.com" 2026/11/14 09:18:10 [error] 3997144#3997144: 4453133 access forbidden by rule, client: 104.28.196.79, server: binixo.com, request: "GET /.env.backup HTTP/2.0", host: "binixo.com" 2026/11/14 09:18:10 [error] 3997144#3997144: 4453147 access forbidden by rule, client: 104.28.196.79, server: binixo.com, request: "GET /.git/config HTTP/2.0", host: "binixo.com", referrer: "https://www.google.com/search?q=binixo.com" ... show less	Web App Attack
🇦🇺 Klaverstyn	2026-11-14 09:11:14 UTC · (8 hours ago)	Excessive HTTP request rate	Web App Attack
🇫🇷 Baking333	2026-11-14 08:28:25 UTC · (9 hours ago)	[redacted] 104.28.196.79 - - [14/Nov/2026:09:28:24 +0100] "GET /.env HTTP/1.1" 302 6771 0/62165 "https://[redacted]/search?q=[redacted]" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Saf ... show more [redacted] 104.28.196.79 - - [14/Nov/2026:09:28:24 +0100] "GET /.env HTTP/1.1" 302 6771 0/62165 "https://[redacted]/search?q=[redacted]" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" 443 [redacted] 104.28.196.79 - - [14/Nov/2026:09:28:24 +0100] "GET /.[redacted] HTTP/1.1" 302 6771 0/54706 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://[redacted]/bot)" 443 [redacted] 104.28.196.79 - - [14/Nov/2026:09:28:24 +0100] "GET /.git/config HTTP/1.1" 302 6771 0/65900 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" 443 [redacted] 104.28.196.79 - - [14/Nov/2026:09:28:24 +0100] "GET /.[redacted] HTTP/1.1" 302 6771 0/73822 "https://[redacted]/search?q=[redacted]" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" 443 show less	Bad Web Bot Web App Attack
🇩🇪 lespbaj	2026-11-14 08:16:54 UTC · (9 hours ago)	{"time":"2026-11-14T08:16:52+00:00","ip":"104.28.196.79","method":"GET","uri":"/.git/HEAD","ua":"Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36","referer":"http://operacion-e ... show more {"time":"2026-11-14T08:16:52+00:00","ip":"104.28.196.79","method":"GET","uri":"/.git/HEAD","ua":"Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36","referer":"http://operacion-es.com/.git/HEAD"} ... show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-11-14 07:56:27 UTC · (9 hours ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: app.astropot.tech \| Path: /.env.backup \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 1 ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: app.astropot.tech \| Path: /.env.backup \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
Anonymous	2026-11-14 06:50:57 UTC · (10 hours ago)	Automatically blocked after 1 security event. Observed sensitive configuration-file probes. Source: Cloudflare security controls.	Hacking Web App Attack
🇳🇱 Savvii	2026-11-14 06:40:55 UTC · (10 hours ago)	20 attempts against mh-misbehave-ban on frost	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 600 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 166.62.41.190

🇨🇦 85.217.149.42

🇬🇧 35.203.211.125

🇫🇮 213.232.122.53

🇳🇱 195.178.110.26

🇸🇬 178.128.223.121

🇺🇸 147.185.132.215

🇯🇴 94.142.46.114

🇦🇷 74.244.135.241

🇺🇸 70.107.44.74

🇧🇩 220.152.112.117

🇸🇬 209.97.171.173

🇦🇺 172.105.179.230

🇩🇪 151.243.11.149

🇨🇳 106.75.5.165

🇰🇪 102.208.164.247

🇷🇺 87.117.39.199

🇩🇪 77.22.70.198

🇫🇷 51.68.236.93

🇰🇷 221.162.135.178