JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

34.159.221.108

Activity Trending Down

Abuse Confidence Score

100% Critical

60 reports

44 reporters · latest 2 weeks ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 108.221.159.34.bc.googleusercontent.com
Domain Name: google.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

60 from 44 distinct reporters

First reported

October 8th 2026

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 13 🇩🇪 Germany 10 🇳🇱 Netherlands 8

Most common categories Web App Attack 49 Brute-Force 29 Bad Web Bot 25 Port Scan 6 Hacking 6

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 Saec	2026-10-09 05:44:47 (2 weeks ago)	Honeypot caught: /.env via app2.saec.me. UA: Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/).	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
🇬🇧 openstrike.co.uk	2026-10-09 05:15:01 (2 weeks ago)	147 attacks on env grabbing URLs (type 2), password/key grabbing URLs, shell probes, env grabbing URLs, directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2): GET /userfiles?path=../../../../proc/self/environ HTTP/1.1 GET /.git-crede ... show more 147 attacks on env grabbing URLs (type 2), password/key grabbing URLs, shell probes, env grabbing URLs, directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2): GET /userfiles?path=../../../../proc/self/environ HTTP/1.1 GET /.git-credentials HTTP/1.1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1 GET //.env HTTP/1.1 GET /..%2f..%2f.env HTTP/1.1 POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1 GET /.git/HEAD HTTP/1.1 GET /secrets.json HTTP/1.1 show less	Hacking Web App Attack
🇧🇪 Saec	2026-10-09 03:54:53 (2 weeks ago)	Honeypot caught: //.env via api.saec.me. UA: Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/).	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
🇧🇪 Saec	2026-10-09 02:46:47 (2 weeks ago)	Honeypot caught: /.env.production via admin.saec.me. UA: Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/).	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
Anonymous	2026-10-09 02:07:02 (2 weeks ago)	Automated web scanner. Requested suspicious paths: /dist/manifest.json. UTC: 2026-10-09 01:36:00.	Web App Attack
🇩🇪 Holger	2026-10-09 01:58:49 (2 weeks ago)	URL probing: GET /userfiles/x?path=../../.env	Web App Attack
🇧🇪 Saec	2026-10-09 01:18:48 (2 weeks ago)	Jarvis auto-ban: Honeypot /.git/HEAD via saec.me [DE] ASN:Google LLC	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 00:56:48 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:56:42.090007 2026] [security2:error] [pid 14937:ti ... show more (mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:56:42.090007 2026] [security2:error] [pid 14937:tid 14969] [client 34.159.221.108:36842] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|rthomasjr.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rthomasjr.com"] [uri "/z9x8c7v6b5-debug-trigger-rthomasjr.com"] [unique_id "asg7ygHluDcpKg6YNSoqMAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 ciccio diddo	2026-10-08 23:56:05 (2 weeks ago)	High Burst multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 23:22:46 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:22:41.431183 2026] [security2:error] [pid 10423:ti ... show more (mod_security) mod_security (id:210492) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:22:41.431183 2026] [security2:error] [pid 10423:tid 10423] [client 34.159.221.108:46474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "royal-barbershop.com"] [uri "/.env.example"] [unique_id "asglwXvhOQntoMya1qNgxwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 on-com	2026-10-08 23:22:32 (2 weeks ago)	URL scan	Brute-Force Web App Attack
🇩🇪 palzer.IT	2026-10-08 23:08:51 (2 weeks ago)	Fail2ban automatic report for plesk-apache-badbot: 34.159.221.108 - - [09/Oct/2026:01:08:18 +0200] GET /lrccgmxvppwxdyrbcpvh [DOMAIN_REMOVED] 404 6438 [DOMAIN_REMOVED] Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +cla ... show more Fail2ban automatic report for plesk-apache-badbot: 34.159.221.108 - - [09/Oct/2026:01:08:18 +0200] GET /lrccgmxvppwxdyrbcpvh [DOMAIN_REMOVED] 404 6438 [DOMAIN_REMOVED] Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@[DOMAIN_REMOVED]) show less	Bad Web Bot
Anonymous	2026-10-08 23:03:39 (2 weeks ago)	Fail2Ban apache-noscript	Bad Web Bot
🇪🇸 arturotrenard	2026-10-08 22:43:41 (2 weeks ago)	WordPress attack blocked (wp-defender): exploit-probe: https://rotulosag.com/_image?href=%2F..%2F..%2F..%2F.env	Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 22:31:03 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 18:30:59.915393 2026] [security2:error] [pid 12335:ti ... show more (mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 18:30:59.915393 2026] [security2:error] [pid 12335:tid 12335] [client 34.159.221.108:35726] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|rotarymagnetics.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rotarymagnetics.com"] [uri "/z9x8c7v6b5-debug-trigger-rotarymagnetics.com"] [unique_id "asgZo0su-PTYKFZzTRESlAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 60 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇬🇧 192.248.150.180

🇦🇷 181.20.210.216

🇱🇰 112.135.100.21

🇺🇸 89.238.174.132

🇺🇸 66.132.186.245

🇺🇸 64.62.197.148

🇳🇴 46.15.144.139

🇺🇸 20.65.217.207

🇹🇼 198.235.24.115

🇳🇱 193.47.62.69

🇰🇷 175.209.156.146

🇸🇬 165.154.236.104

🇺🇸 157.254.18.71

🇺🇸 152.163.145.195

🇫🇮 147.185.133.148

🇷🇺 145.255.8.223

🇨🇳 112.49.119.166

🇧🇪 104.199.36.53

🇵🇰 103.102.157.30

🇬🇧 90.253.212.223