JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.196.173.204

104.196.173.204 was found in our database!

This IP was reported 82 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	204.173.196.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	North Charleston, South Carolina

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.196.173.204

Whois 104.196.173.204

IP Abuse Reports for 104.196.173.204:

This IP address has been reported a total of 82 times from 59 distinct sources. 104.196.173.204 was first reported on July 29th 2025, and the most recent report was 37 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 MatCat	2026-09-01 11:05:10 (37 minutes ago)	Banned by fail2ban: apache-webprobe	Port Scan Bad Web Bot
Anonymous	2026-09-01 10:07:03 (1 hour ago)	Automated web scanner. Requested suspicious paths: /.env.production \| /.env.example \| /_ignition/hea ... show more Automated web scanner. Requested suspicious paths: /.env.production \| /.env.example \| /_ignition/health-check \| /.env.dev \| /.env.bak \| /.env.backup \| /.env.old \| /crusader-404-probe \| /actuator/configprops \| /storage/logs/laravel.log \| /.env.prod \| /env \| /.env.local \| /.env \| /actuator/env. UTC: 2026-09-01 09:13:01. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 08:24:58 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.196.173.204 (204.173.196.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.196.173.204 (204.173.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:24:52.991825 2026] [security2:error] [pid 2475:tid 2475] [client 104.196.173.204:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mcbrude.com"] [uri "/.env.old"] [unique_id "apaL1AFYqMcu1CMArE1wpwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 08:20:54 (3 hours ago)	104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.local HTTP/1.1" 403 199 "-" "crusader-wo ... show more 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.local HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.bak HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.old HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.backup HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.prod HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 104.196.173.204 - - [01/Sep/2026:03:20:53 -0500] "GET /.env.dev HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 104.196.173.204 ... show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-01 07:32:21 (4 hours ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇮🇳 evicky2002	2026-08-31 00:01:03 (1 day ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇫🇷 Catalin Negru	2026-08-30 22:05:34 (1 day ago)	Recidive ban by fail2ban on server.blackbit.ro	Brute-Force
🇫🇷 service Informatique	2026-08-30 04:00:37 (2 days ago)	GET /wp-config	Web App Attack
🇺🇸 ssssssssssssssssssssuper	2026-08-30 03:46:45 (2 days ago)	104.196.173.204 - - [29/Aug/2026:23:46:43 -0400] "GET /wp-config.php~ HTTP/1.1" 404 65161 "-" "crusa ... show more 104.196.173.204 - - [29/Aug/2026:23:46:43 -0400] "GET /wp-config.php~ HTTP/1.1" 404 65161 "-" "crusader-worker/1.0" 104.196.173.204 - - [29/Aug/2026:23:46:44 -0400] "GET /.env.save HTTP/1.1" 404 70574 "-" "crusader-worker/1.0" 104.196.173.204 - - [29/Aug/2026:23:46:44 -0400] "GET /.env.backup HTTP/1.1" 404 70574 "-" "crusader-worker/1.0" ... show less	Port Scan Hacking Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-08-30 03:30:00 (2 days ago)	[redacted] 104.196.173.204 - - [30/Aug/2026:04:29:59 +0100] "GET /.[redacted] HTTP/1.1" 200 5423 0/1 ... show more [redacted] 104.196.173.204 - - [30/Aug/2026:04:29:59 +0100] "GET /.[redacted] HTTP/1.1" 200 5423 0/16011 "-" "crusader-worker/1.0" [redacted] 104.196.173.204 - - [30/Aug/2026:04:29:59 +0100] "GET /.[redacted] HTTP/1.1" 200 5423 0/25592 "-" "crusader-worker/1.0" [redacted] 104.196.173.204 - - [30/Aug/2026:04:29:59 +0100] "GET /.[redacted] HTTP/1.1" 200 5423 0/21890 "-" "crusader-worker/1.0" show less	Bad Web Bot Web App Attack
🇩🇪 Phenix Info	2026-08-30 03:28:31 (2 days ago)	SmallGuard.fr/Prestashop Forbidden Ext.	Web App Attack
🇩🇪 big-cloud.nl	2026-08-30 00:24:40 (2 days ago)	Try to access /.env	Web App Attack
🇿🇦 conure.sh	2026-08-29 12:01:37 (2 days ago)	csagent: score 20.5: 404 noise floor x2, secrets grab x1, wp-config backup grab x1; 1 domain(s) in 0 ... show more csagent: score 20.5: 404 noise floor x2, secrets grab x1, wp-config backup grab x1; 1 domain(s) in 0s show less	Web App Attack
🇩🇪 gadix	2026-08-29 01:59:08 (3 days ago)	[29/Aug/2026:03:59:07.366362 +0200] apI8697z4ql3U73Vf52jHgAAAAk 104.196.173.204 39526 127.0.0.1 7081 ... show more [29/Aug/2026:03:59:07.366362 +0200] apI8697z4ql3U73Vf52jHgAAAAk 104.196.173.204 39526 127.0.0.1 7081 [29/Aug/2026:03:59:07.368014 +0200] apI8697z4ql3U73Vf52jHwAAAAI 104.196.173.204 39516 127.0.0.1 7081 [29/Aug/2026:03:59:07.370263 +0200] apI8697z4ql3U73Vf52jIAAAABU 104.196.173.204 39528 127.0.0.1 7081 ... show less	Web App Attack
🇬🇧 andypiper	2026-08-29 01:02:03 (3 days ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack

Showing 1 to 15 of 82 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.155

🇩🇪 188.68.49.235

🇮🇳 182.70.255.242

🇫🇮 147.185.133.56

🇺🇿 84.54.72.174

🇩🇪 65.111.28.239

🇻🇳 45.117.83.143

🇭🇰 43.161.246.125

🇺🇸 216.25.89.155

🇬🇧 195.96.139.109

🇻🇳 103.167.89.222

🇭🇰 223.17.1.118

🇿🇦 197.85.190.30

🇧🇷 179.209.45.211

🇫🇷 172.71.134.186

🇮🇳 167.71.234.76

🇺🇸 147.185.132.209

🇸🇬 129.226.193.111

🇸🇬 43.156.250.119

🇦🇺 34.40.253.3