JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.199.166.238

104.199.166.238 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 73%: ?

73%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	238.166.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇹🇼 Taiwan
City	Taipei, Taiwan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.199.166.238

Whois 104.199.166.238

IP Abuse Reports for 104.199.166.238:

This IP address has been reported a total of 21 times from 13 distinct sources. 104.199.166.238 was first reported on September 15th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-16 22:01:58 (22 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-15. show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-09-16 10:40:53 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 06:40:49.504285 2026] [security2:error] [pid 17714:tid 17714] [client 104.199.166.238:43158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.londongroup.info"] [uri "/.git/config"] [unique_id "aqpyMZn9DsOVkpfdlHpOyAAAACw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 10:14:49 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 06:14:46.064197 2026] [security2:error] [pid 25536:tid 25536] [client 104.199.166.238:59538] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lonasytoldosdelatorre.com.disenowebprofesional.com"] [uri "/.git/config"] [unique_id "aqpsFiEtdb_IvkLEvTVvtQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 05:23:56 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 01:23:49.625722 2026] [security2:error] [pid 9995:tid 10043] [client 104.199.166.238:49360] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.catch-22productions.ceol.us"] [uri "/.git/config"] [unique_id "aqon5bJBFVxfqYrHR7ECXAAAAc4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-09-16 05:20:05 (1 day ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 netman	2026-09-16 04:54:48 (1 day ago)	HTTP: 104.199.166.238 blocked because of 100 failures ...	DDoS Attack Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 03:03:47 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 23:03:41.021108 2026] [security2:error] [pid 28254:tid 28254] [client 104.199.166.238:47480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.log.oxfordgliding.com"] [uri "/.git/config"] [unique_id "aqoHDdq7LvJcUP9QLCEe8gAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-16 02:36:58 (1 day ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /.git/config \| 2026-09-16 02:36 UTC show less	Hacking Web App Attack
🇳🇱 Site.eu	2026-09-16 02:09:38 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 homeshowdomain.nl	2026-09-15 22:00:19 (1 day ago)	Auto-ban: >3000 req/min op 2026-09-15	Web App Attack SSH Hacking
🇳🇱 Mangelot Hosting	2026-09-15 21:07:44 (1 day ago)	(modsecurity) srv101 ModSecurity 104.199.166.238 (TW/Taiwan/238.166.199.104.bc.googleusercontent.com ... show more (modsecurity) srv101 ModSecurity 104.199.166.238 (TW/Taiwan/238.166.199.104.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 18:28:57 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 14:28:50.495985 2026] [security2:error] [pid 12992:tid 13025] [client 104.199.166.238:37536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.logedeparfaits.com.aafm.us"] [uri "/.git/config"] [unique_id "aqmOYpp3m5-GjkRyLfGZaAAAAVg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-09-15 17:07:06 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 16:59:01 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.166.238 (238.166.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 12:58:55.414795 2026] [security2:error] [pid 6254:tid 6254] [client 104.199.166.238:33576] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.deoudewindpomp.jbaydeliveries.com"] [uri "/.git/config"] [unique_id "aql5Tx0MuSJ5DcePC_1K_AAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-15 14:48:25 (2 days ago)	[ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-11al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.199.166.238 - - [15/Sep/2026:16:48:07 +0200] "GET /.git/config HTTP/1.1" 410 415 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 199.91.128.98

🇺🇬 196.0.3.188

🇯🇵 194.5.48.185

🇬🇧 193.163.125.5

🇳🇱 193.47.62.69

🇨🇦 104.223.85.26

🇺🇸 91.230.168.182

🇺🇸 66.132.195.27

🇳🇱 45.148.10.157

🇧🇷 205.210.31.185

🇺🇸 205.210.31.49

🇨🇦 184.160.121.37

🇵🇾 181.94.227.59

🇺🇸 166.88.83.201

🇭🇰 150.5.148.103

🇺🇸 76.111.136.106

🇺🇸 72.49.21.79

🇯🇵 49.212.156.173

🇺🇸 20.84.165.20

🇺🇸 20.42.81.166