JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

34.52.229.253

Recent Activity

Abuse Confidence Score

100% Critical

3,862 reports

916 reporters · latest 3 hours ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 253.229.52.34.bc.googleusercontent.com
Domain Name: google.com
Country: 🇧🇪 Belgium
City: Brussels, Brussels Capital

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

3,862 from 916 distinct reporters

First reported

September 16th 2026

Most recent report

3 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 1,022 🇺🇸 United States of America 622 🇳🇱 Netherlands 400

Most common categories Web App Attack 3,017 Brute-Force 1,105 Bad Web Bot 1,087 Hacking 797 Port Scan 327

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-11-01 03:31:37 (3 hours ago)	Automated block on a production VoIP/web server: web application probing for non-existent entry points on port 80,443/tcp after 3 detected failures. Blocked automatically at the host.	Web App Attack Bad Web Bot
🇳🇱 tmiland	2026-10-31 23:11:16 (8 hours ago)	Detected 114 connections from 34.52.229.253 last 10 minutes.; 34.52.229.253 is part of network 34.0.0.0 with 30 source(s) (2379 connections) in the last 10 minutes; Logs: 34.52.229.253 - - [19/Oct/2026:21:54:51 +0200] "GET / HTTP/1.1" 302 138 "-" "Mo ... show more Detected 114 connections from 34.52.229.253 last 10 minutes.; 34.52.229.253 is part of network 34.0.0.0 with 30 source(s) (2379 connections) in the last 10 minutes; Logs: 34.52.229.253 - - [19/Oct/2026:21:54:51 +0200] "GET / HTTP/1.1" 302 138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" 34.52.229.253 - - [19/Oct/2026:21:54:52 +0200] "GET /service-worker.js HTTP/1.1" 302 138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" 34.52.229.253 - - [19/Oct/2026:21:54:52 +0200] "GET /unauthenticated/js/session-login.min.js?26502009999999999 HTTP/1.1" 302 138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" 34.52.229.253 - - [19/Oct/2026:21:54:52 +0200] "GET /.git/config HTTP/1.1" 302 138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [19/Oct/2026:21:5 show less	DDoS Attack Bad Web Bot Web App Attack
🇧🇷 Peregrine	2026-10-31 03:15:11 (1 day ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 34.52.229.253 172.69.222.137 - - [18/Oct/2026:19:37:14 -0300] "GET /.docker/.env HTTP/1.1" 404 18193	Bad Web Bot
🇩🇪 jocurionline	2026-10-31 02:30:04 (1 day ago)	Auto-blocked by WAF: AUTO-BAN: Blocked request + AbuseIPDB 7 zile	Web App Attack
🇵🇱 Budyn	2026-10-30 17:16:36 (1 day ago)	[BUDYN \| Budyn SOC Canary] \| Event: AWS Key Compromised! \| Evidence: \| Memo: AWS_Token_3 \| Action: AWS API Call \| Token ID: 4tpvosl7k2etr0dcza06lsb9g \| Client tool: aws-sdk-dotnet-coreclr/3.7.500.0 ua/2.0 os/linux#7.0.0.1011 md/ARCH#X64 lang/.NET_Cor ... show more [BUDYN \| Budyn SOC Canary] \| Event: AWS Key Compromised! \| Evidence: \| Memo: AWS_Token_3 \| Action: AWS API Call \| Token ID: 4tpvosl7k2etr0dcza06lsb9g \| Client tool: aws-sdk-dotnet-coreclr/3.7.500.0 ua/2.0 os/linux#7.0.0.1011 md/ARCH#X64 lang/.NET_Core#8.0.25 md/aws-sdk-dotnet-core#3.7.500.0 api/EC2#3.7.500.0 cfg/retry-mo... show less	Hacking Bad Web Bot Web App Attack
🇺🇸 EmilGH	2026-10-30 16:45:29 (1 day ago)	34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.amplifyrc HTTP/1.1" 403 807 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.aws/config HTTP/1.1" 403 468 "-" "Mozilla/5.0 ( ... show more 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.amplifyrc HTTP/1.1" 403 807 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.aws/config HTTP/1.1" 403 468 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.aws/credentials HTTP/1.1" 403 468 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.aws/credentials.bak HTTP/1.1" 403 792 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.aws/.env HTTP/1.1" 403 792 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.boto HTTP/1.1" 403 792 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:16:45:28 +0000] "GET /.claude/settings.json HTTP/1.1" 403 792 "- ... show less	Bad Web Bot Web App Attack
🇺🇸 PlexLads	2026-10-30 16:41:33 (1 day ago)	34.52.229.253 - - [30/Oct/2026:09:41:32 -0700] "GET /.aws/.env HTTP/1.1" 307 700 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:09:41:32 -0700] "GET /.env-example HTTP/1.1" 307 1024 "-" "Mozilla/5.0 ... show more 34.52.229.253 - - [30/Oct/2026:09:41:32 -0700] "GET /.aws/.env HTTP/1.1" 307 700 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 34.52.229.253 - - [30/Oct/2026:09:41:32 -0700] "GET /.env-example HTTP/1.1" 307 1024 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" show less	Hacking Web App Attack
🇩🇪 maxpower	2026-10-30 16:40:38 (1 day ago)	(PERMBLOCK) 34.52.229.253 (BE/Belgium/253.229.52.34.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:	Port Scan
🇫🇷 pawel	2026-10-30 16:16:36 (1 day ago)	[Fri Oct 30 17:16:35.457030 2026] [php:error] [pid 739277] [client 34.52.229.253:34270] script '/home/pawel/biuro/.env.php' not found or unable to stat [Fri Oct 30 17:16:35.553740 2026] [php:error] [pid 739382] [client 34.52.229.253:34288] script '/h ... show more [Fri Oct 30 17:16:35.457030 2026] [php:error] [pid 739277] [client 34.52.229.253:34270] script '/home/pawel/biuro/.env.php' not found or unable to stat [Fri Oct 30 17:16:35.553740 2026] [php:error] [pid 739382] [client 34.52.229.253:34288] script '/home/pawel/biuro/info.php' not found or unable to stat [Fri Oct 30 17:16:35.565632 2026] [php:error] [pid 739281] [client 34.52.229.253:34242] script '/home/pawel/biuro/phpinfo.php' not found or unable to stat ... show less	Bad Web Bot Web App Attack
🇦🇺 paulshipley.com.au	2026-10-30 16:16:09 (1 day ago)	[Sat Oct 31 03:16:09.100918 2026] [security2:error] [pid 638852] [client 34.52.229.253:46782] [client 34.52.229.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ... show more [Sat Oct 31 03:16:09.100918 2026] [security2:error] [pid 638852] [client 34.52.229.253:46782] [client 34.52.229.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bermanfamily.com.au"] [uri "/.aws/.env"] [unique_id "auTCyTzsvSaiK4Gf-YNBtQAAAAA"] ... show less	Web App Attack
🇳🇦 jacqueskruger	2026-10-30 16:14:24 (1 day ago)	Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-10-30T16:07:27Z. Evidence: repeated distinct requests matchin ... show more Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 1 confirmed alerts / 2 triggering events. Detections: high-confidence-scanner. Latest evidence UTC: 2026-10-30T16:07:27Z. Evidence: repeated distinct requests matching our high-confidence scanner rules. show less	Bad Web Bot
Anonymous	2026-10-30 16:13:14 (1 day ago)	34.52.229.253 - - [30/Oct/2026:16:13:13 +0000] "GET /.docker/laravel/app/.env HTTP/2.0" 404 3709 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ...	Bad Web Bot Web App Attack
🇺🇸 HamSammich	2026-10-30 16:00:01 (1 day ago)	Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-10-30T16:00Z).	Port Scan Web App Attack
🇺🇸 kadour	2026-10-30 15:58:26 (1 day ago)	[Fri Oct 30 10:58:25.269689 2026] [proxy_fcgi:error] [pid 2576:tid 2701] [client 34.52.229.253:42510] AH01071: Got error 'Primary script unknown' [Fri Oct 30 10:58:25.617756 2026] [proxy_fcgi:error] [pid 2576:tid 2709] [client 34.52.229.253:42510] AH ... show more [Fri Oct 30 10:58:25.269689 2026] [proxy_fcgi:error] [pid 2576:tid 2701] [client 34.52.229.253:42510] AH01071: Got error 'Primary script unknown' [Fri Oct 30 10:58:25.617756 2026] [proxy_fcgi:error] [pid 2576:tid 2709] [client 34.52.229.253:42510] AH01071: Got error 'Primary script unknown' [Fri Oct 30 10:58:25.733677 2026] [proxy_fcgi:error] [pid 74306:tid 74354] [client 34.52.229.253:42518] AH01071: Got error 'Primary script unknown' [Fri Oct 30 10:58:25.811128 2026] [proxy_fcgi:error] [pid 2575:tid 2750] [client 34.52.229.253:42420] AH01071: Got error 'Primary script unknown' [Fri Oct 30 10:58:25.851404 2026] [proxy_fcgi:error] [pid 2576:tid 2685] [client 34.52.229.253:42480] AH01071: Got error 'Primary script unknown' ... show less	Web App Attack
🇬🇧 ProCleanerUK	2026-10-30 15:53:59 (1 day ago)	Honeypot hit on ServiceOS: /api/actuator/env (UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36)	Web App Attack Bad Web Bot

Showing 1 to 15 of 3862 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇦 193.33.189.40

🇦🇷 179.36.97.73

🇭🇰 165.154.62.190

🇩🇪 109.160.32.118

🇺🇸 65.49.1.164

🇪🇸 64.177.33.2

🇳🇱 45.148.10.157

🇺🇸 44.248.120.166

🇬🇧 35.203.210.239

🇹🇼 35.189.173.178

🇧🇪 34.156.64.240

🇺🇸 20.42.56.139

🇫🇷 5.49.231.41

🇳🇱 185.136.15.81

🇺🇸 162.216.149.42

🇭🇰 152.32.171.213

🇨🇦 148.113.179.10

🇺🇸 144.225.8.54

🇮🇹 109.53.142.28

🇺🇸 98.174.37.201