JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.198.29.149

Recent Activity

Abuse Confidence Score

100% Critical

25 reports

25 reporters · latest 1 day ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 149.29.198.104.bc.googleusercontent.com
Domain Name: google.com
Country: 🇺🇸 United States of America
City: Council Bluffs, Iowa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

25 from 25 distinct reporters

First reported

October 27th 2026

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 6 🇩🇪 Germany 5 🇨🇦 Canada 2

Most common categories Web App Attack 20 Brute-Force 6 Hacking 5 Bad Web Bot 4 DDoS Attack 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-10-27 18:08:53 (1 day ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-27 UTC.	Brute-Force
Anonymous	2026-10-27 12:20:58 (1 day ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇺🇸 LSPCCU	2026-10-27 12:02:29 (1 day ago)	TSEC Honeypot Network report. Threat score: 73/100. Categories: Hacking, Brute-Force, Web App Attack, SSH. Honeypot: galah, h0neytr4p. Context: 104.198.29.149 classified as automated brute-force attacker targeting SSH/Telnet credentials (high confide ... show more TSEC Honeypot Network report. Threat score: 73/100. Categories: Hacking, Brute-Force, Web App Attack, SSH. Honeypot: galah, h0neytr4p. Context: 104.198.29.149 classified as automated brute-force attacker targeting SSH/Telnet credentials (high confidence). show less	Hacking Brute-Force Web App Attack SSH
🇦🇺 Klaverstyn	2026-10-27 09:45:11 (1 day ago)	Excessive HTTP request rate	Web App Attack
🇳🇱 BlueWire Hosting	2026-10-27 09:40:55 (1 day ago)	Probing websites for vulnerabilities	Web App Attack
🇺🇸 IndigoRidge	2026-10-27 09:26:35 (1 day ago)	104.198.29.149 - - [27/Oct/2026:05:26:33 -0400] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 5647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct ... show more 104.198.29.149 - - [27/Oct/2026:05:26:33 -0400] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 5647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:05:26:33 -0400] "GET //xmlrpc.php?rsd HTTP/1.1" 403 6515 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:05:26:34 -0400] "GET //?author=1 HTTP/1.1" 301 5629 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:05:26:34 -0400] "GET //?author=2 HTTP/1.1" 301 5520 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:05:26:34 -0400] "GET //?author=3 HTTP/1.1" 301 5629 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH ... show less	Web App Attack
🇳🇱 Site.eu	2026-10-27 09:20:58 (1 day ago)	WordPress login brute force (wp-login/xmlrpc login attempts)	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-10-27 09:20:07 (1 day ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇬🇧 venus.launch.bz	2026-10-27 09:09:29 (1 day ago)	(wpscan) WordPress probe detected from 104.198.29.149 (US/United States/149.29.198.104.bc.googleusercontent.com)	Hacking
🇩🇪 Vegascosmetics	2026-10-27 09:08:59 (1 day ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after first-seen suspicion / AbuseIPDB reputation policy (no URL signature). Evidence: Suspicion-Ban (Score 75>=65, Abuse 80, NonEU, first-seen)	Hacking Exploited Host Web App Attack
🇫🇮 paissangroup	2026-10-27 09:07:52 (1 day ago)	Multiple WAF Violations	Web App Attack
🇩🇪 yitzhaq	2026-10-27 09:06:18 (1 day ago)	104.198.29.149 - - [27/Oct/2026:10:06:14 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 4267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct ... show more 104.198.29.149 - - [27/Oct/2026:10:06:14 +0100] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 4267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:10:06:14 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 524 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:10:06:15 +0100] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 524 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:10:06:15 +0100] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 524 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.198.29.149 - - [27/Oct/2026:10:06:15 +0100] "GET //website/wp-includes/wlwmanifest.x show less	Web App Attack Hacking
🇫🇮 as211431.net	2026-10-27 09:04:03 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: //test/wp-includes/wlwmanifest.xml UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389. ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: //test/wp-includes/wlwmanifest.xml UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 OceanTreasure	2026-10-27 09:03:33 (1 day ago)	tcp/443; Windows Live Writer manifest enumeration: "GET //wp-includes/wlwmanifest.xml" @ 2026-10-27T09:03:33Z [proxy]	Web App Attack
🇺🇸 ambor	2026-10-27 09:03:08 (1 day ago)	Honeypot access: PHP file scan attempt: //xmlrpc.php. Path: //xmlrpc.php	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2a09:bac6:cb20:1187::1bf:b4

🇹🇷 213.14.164.110

🇧🇷 205.210.31.228

🇦🇷 190.105.160.5

🇧🇷 189.34.166.185

🇲🇽 187.211.107.44

🇵🇾 186.158.200.235

🇺🇸 172.172.180.124

🇨🇳 139.224.207.97

🇮🇳 103.248.120.6

🇧🇩 103.149.56.234

🇮🇳 103.89.136.111

🇻🇳 103.6.234.155

🇳🇬 102.90.97.217

🇮🇹 93.65.246.195

🇩🇪 79.202.81.53

🇫🇷 78.24.133.14

🇺🇸 66.240.205.34

🇺🇸 66.132.195.108

🇺🇸 54.204.58.226