JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.197.22.154

104.197.22.154 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 77%: ?

77%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	154.22.197.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	Council Bluffs, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.197.22.154

Whois 104.197.22.154

IP Abuse Reports for 104.197.22.154:

This IP address has been reported a total of 15 times from 12 distinct sources. 104.197.22.154 was first reported on June 13th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Roderic	2026-06-13 16:59:01 (15 hours ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇺🇸 mnsf	2026-06-13 16:05:33 (16 hours ago)	Abuse Detected (12)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 15:13:42 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.197.22.154 (154.22.197.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.197.22.154 (154.22.197.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 11:13:38.324913 2026] [security2:error] [pid 10383:tid 10405] [client 104.197.22.154:35854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newyorkplasticsurgery.us"] [uri "/v1/.env"] [unique_id "ai1zouNGloUCuZFupDheMQAAARM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-13 14:57:12 (17 hours ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 12:40:21 (20 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.197.22.154 (154.22.197.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.197.22.154 (154.22.197.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 08:40:15.201210 2026] [security2:error] [pid 18168:tid 18168] [client 104.197.22.154:37718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.iconbizpromo.com"] [uri "/.env.copy"] [unique_id "ai1PrxIcoRdHY57Xevc2uwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2026-06-13 10:59:56 (21 hours ago)	http-sensitive-files - IP: 104.197.22.154 - time="2026-06-13T12:59:55+02:00" level=info msg="(555f6 ... show more http-sensitive-files - IP: 104.197.22.154 - time="2026-06-13T12:59:55+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 104.197.22.154 (US/396982) : 4h ban on Ip 104.197.22.154" module=db show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 09:58:36 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.197.22.154 (154.22.197.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.197.22.154 (154.22.197.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 05:58:29.960361 2026] [security2:error] [pid 15005:tid 15005] [client 104.197.22.154:45896] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abq4you.com"] [uri "/.env.sample"] [unique_id "ai0pxQbPlVwnNjCUfppBOQAAAGk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 updown.io	2026-06-13 08:46:23 (23 hours ago)	{"level":"info","ts":1781340380.0781546,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1781340380.0781546,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.197.22.154","remote_port":"56276","client_ip":"104.197.22.154","proto":"HTTP/1.1","method":"GET","host":"lkjihgfedwww.gc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.env.qa","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.000044274,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://lkjihgfedwww.gc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.env.qa"],"Content-Type":[]}} {"level":"info","ts":1781340380.0788846,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.197.22.154","remote_port":"56284","client_ip":"104.197.22.154" ... show less	DDoS Attack Web App Attack
🇺🇸 mnsf	2026-06-13 07:06:59 (1 day ago)	Scanning/Probing (27)	Brute-Force Web App Attack
🇫🇷 masterguru	2026-06-13 06:31:37 (1 day ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇫🇷 Octopuce	2026-06-13 05:42:57 (1 day ago)	Aggressive web search of vulnerable pages: /.env.local /v2/.env /prod/.env /api/.env /production/.en ... show more Aggressive web search of vulnerable pages: /.env.local /v2/.env /prod/.env /api/.env /production/.env ... show less	Web App Attack
🇩🇪 grassau.com	2026-06-13 05:31:45 (1 day ago)	Port Scan detected from 104.197.22.154 (US/United States/Iowa/Council Bluffs/154.22.197.104.bc.goo ... show more Port Scan detected from 104.197.22.154 (US/United States/Iowa/Council Bluffs/154.22.197.104.bc.googleusercontent.com). show less	Port Scan
🇩🇪 paissangroup	2026-06-13 05:25:54 (1 day ago)	Multiple WAF Violations	Web App Attack
🇳🇱 Savvii	2026-06-13 03:36:13 (1 day ago)	20 attempts against mh-misbehave-ban on boron	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-06-13 03:21:41 (1 day ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/api/.env.bak	Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 112.103.94.205

🇬🇧 31.14.254.26

🇳🇱 195.211.191.112

🇸🇪 192.71.142.176

🇺🇸 172.234.21.101

🇨🇦 157.208.6.48

🇺🇸 139.177.207.222

🇳🇱 45.148.10.151

🇻🇳 14.226.69.46

🇺🇸 107.151.195.131

🇯🇵 74.176.205.111

🇩🇪 69.5.169.82

🇳🇱 45.153.34.114

🇮🇹 5.249.144.192

🇩🇪 213.209.159.56

🇬🇧 185.192.71.234

🇺🇸 172.237.150.127

🇺🇸 162.216.149.168

🇬🇧 144.126.227.130

🇬🇧 91.230.225.177