JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.199.45.220

Activity Trending Down

Abuse confidence score ?

56% Elevated

62 reports

42 reporters · latest 1 month ago

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	220.45.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 104.199.45.220

Export CSV

This IP address has been reported a total of 62 times from 42 distinct sources. 104.199.45.220 was first reported on September 11th 2026, and the most recent report was 1 month ago. In the last 60 days, the top reporter locations were: Germany with 18 reports; United States of America with 16 reports; France with 7 reports. The most common categories in these recent reports were: Web App Attack 49 times; Brute-Force 29 times; Bad Web Bot 22 times; Hacking 11 times; Port Scan 4 times; Other 5 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 eposs-it.de	2026-09-14 11:05:09 (1 month ago)	Blocked by os-abuseipdb; 8 hits, proto=tcp, ports=443,80	Port Scan Hacking
Anonymous	2026-09-14 08:05:18 (1 month ago)	104.199.45.220 - - [14/Sep/2026:10:05:17 +0200] "GET /.git-credentials HTTP/2.0" 301 169 "-" "Mozill ... show more 104.199.45.220 - - [14/Sep/2026:10:05:17 +0200] "GET /.git-credentials HTTP/2.0" 301 169 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https:///support/amazonbot)" show less	Bad Web Bot
🇮🇳 evicky2002	2026-09-14 06:00:01 (1 month ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇳🇱 WeCloudit-Anti-Abuse	2026-09-14 02:30:21 (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing	Web App Attack Hacking
🇫🇷 dwmp	2026-09-13 21:54:05 (1 month ago)	Url probing: /__/firebase/init.json	Web App Attack
🇳🇱 middelkoopcc	2026-09-13 14:38:00 (1 month ago)	2026-09-13 16:36:00 GET /settings.json [301] && 2026-09-13 16:36:01 GET /__/firebase/init.json [301] ... show more 2026-09-13 16:36:00 GET /settings.json [301] && 2026-09-13 16:36:01 GET /__/firebase/init.json [301] && 2026-09-13 16:36:01 GET /.git-credentials [301] && 183 more within 20 minutes show less	Web App Attack
Anonymous	2026-09-13 13:20:02 (1 month ago)	\| Multiple common web attacks from same source ip. (multiple servers)	Web App Attack Hacking SQL Injection
🇦🇺 paulshipley.com.au	2026-09-13 11:16:11 (1 month ago)	[Sun Sep 13 21:16:11.513093 2026] [security2:error] [pid 896096] [client 104.199.45.220:40980] [clie ... show more [Sun Sep 13 21:16:11.513093 2026] [security2:error] [pid 896096] [client 104.199.45.220:40980] [client 104.199.45.220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.info"] [uri "/.aws/config"] [unique_id "aqaF-wKvwJ3RM3oxNVK1owAAAA0"] ... show less	Web App Attack
Anonymous	2026-09-13 10:57:38 (1 month ago)	[Sun Sep 13 12:57:35.645629 2026] [access_compat:error] [pid 1424525:tid 1424525] [client 104.199.45 ... show more [Sun Sep 13 12:57:35.645629 2026] [access_compat:error] [pid 1424525:tid 1424525] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/rclone.conf, referer: https://loretlargent.info/rclone.conf [Sun Sep 13 12:57:35.659769 2026] [access_compat:error] [pid 1424059:tid 1424059] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.aws, referer: https://loretlargent.info/.aws/config [Sun Sep 13 12:57:35.668544 2026] [access_compat:error] [pid 1423481:tid 1423481] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.aws, referer: https://loretlargent.info/.aws/credentials [Sun Sep 13 12:57:36.531302 2026] [access_compat:error] [pid 1423323:tid 1423323] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.docker, referer: https://loretlargent.info/.docker/confi ... show less	Web Spam Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 10:56:51 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 06:56:43.607497 2026] [security2:error] [pid 24525:tid 24525] [client 104.199.45.220:46972] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|londongroup.info\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "londongroup.info"] [uri "/rclone.conf"] [unique_id "aqaBa4SjHeNMrUkRYd7osQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-13 10:43:58 (1 month ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /dist/manifest.json (+6 more) \| 2026-09-13 10:43 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 10:18:43 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 06:18:38.575941 2026] [security2:error] [pid 10236:tid 10236] [client 104.199.45.220:48120] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|keystroke.info\|F\|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystroke.info"] [uri "/LocalSettings.php.backup"] [unique_id "aqZ4fu6IHX41PT3F8BRMZQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-09-13 10:01:59 (1 month ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 104.199.45.220 (BE/Belgium/220.45.199.10 ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 104.199.45.220 (BE/Belgium/220.45.199.104.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.199.45.220 - - [13/Sep/2026:12:01:57 +0200] "GET /.ssh/id_dsa HTTP/2.0" 200 12141 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)" "-" host=johnfante.info show less	Port Scan
🇳🇱 debestelapp	2026-09-13 10:00:11 (1 month ago)		Web App Attack
Anonymous	2026-09-13 09:42:01 (1 month ago)	Bot / scanning and/or hacking attempts: GET /server-info HTTP/2.0, GET /pi.php HTTP/2.0, GET /elmah. ... show more Bot / scanning and/or hacking attempts: GET /server-info HTTP/2.0, GET /pi.php HTTP/2.0, GET /elmah.axd HTTP/2.0, GET /info.php HTTP/2.0, GET /nginx_status HTTP/2.0, POST /read-document HTTP/2.0, GET /actuator/loggers HTTP/2.0, DELETE /api/inngest HTTP/2.0, GET /_profiler/open HTTP/2.0, GET /_debugbar/open HTTP/2.0, GET /app_dev.php/_profiler HTTP/2.0, GET /__debug__/ HTTP/2.0, GET /actuator/mappings HTTP/2.0, GET /phpinfo.php HTTP/2.0, POST /api/v1/validate/code HTTP/2.0, POST /api HTTP/2.0, POST /api/fs/exec HTTP/2.0, POST /mcp HTTP/2.0, GET /i.php HTTP/2.0, GET /_ignition/health-check HTTP/2.0, GET /app_dev.php HTTP/2.0, GET /trace.axd HTTP/2.0, GET /test.php HTTP/2.0, DELETE /inngest HTTP/2.0 show less	Hacking Web App Attack

Showing 1 to 15 of 62 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 131.108.119.180

🇺🇿 109.94.173.9

🇸🇬 103.189.234.27

🇧🇪 34.38.66.148

🇩🇪 5.231.242.210

🇺🇸 2620:24:c040:4::2e8

🇮🇩 210.79.142.203

🇩🇪 195.182.16.183

🇬🇧 193.163.125.63

🇺🇸 184.154.245.42

🇳🇿 180.149.231.6

🇩🇪 151.243.11.45

🇩🇪 146.103.57.68

🇨🇳 124.222.229.150

🇨🇳 123.187.244.19

🇫🇷 109.205.180.231

🇮🇩 103.113.170.231

🇬🇧 82.20.118.121

🇳🇱 77.239.124.148

🇩🇪 69.5.169.148