JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.199.18.193

104.199.18.193 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 89%: ?

89%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	193.18.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.199.18.193

Whois 104.199.18.193

IP Abuse Reports for 104.199.18.193:

This IP address has been reported a total of 22 times from 22 distinct sources. 104.199.18.193 was first reported on October 7th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-07 10:13:55 (1 week ago)	Unauthorised traffic to honeypot	Port Scan
🇵🇱 dzpk	2026-10-07 10:01:18 (1 week ago)	[07/Oct/2026:12:01:14 +0200] 179136727426.696342 104.199.18.193 25930 HOST 443 [07/Oct/2026:12:01:14 ... show more [07/Oct/2026:12:01:14 +0200] 179136727426.696342 104.199.18.193 25930 HOST 443 [07/Oct/2026:12:01:14 +0200] 179136727469.494037 104.199.18.193 25936 HOST 443 [07/Oct/2026:12:01:17 +0200] 17913672773.326129 104.199.18.193 25938 HOST 443 show less	Web App Attack
Anonymous	2026-10-07 09:53:03 (1 week ago)	Reported from Nginx log analysis 17. Log: 104.199.18.193 - - [07/Oct/2026:xx:xx:xx 0200] "GET / HTT ... show more Reported from Nginx log analysis 17. Log: 104.199.18.193 - - [07/Oct/2026:xx:xx:xx 0200] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-" "BE Belgium Brussels" "AS396982" "Google LLC" show less	Port Scan Brute-Force SSH
🇺🇸 robotstxt	2026-10-07 09:35:39 (1 week ago)	104.199.18.193 - - [07/Oct/2026:09:35:33 +0000] "VHUC / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatib ... show more 104.199.18.193 - - [07/Oct/2026:09:35:33 +0000] "VHUC / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="104.199.18.193" 104.199.18.193 - - [07/Oct/2026:09:35:34 +0000] "GET / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="104.199.18.193" 104.199.18.193 - - [07/Oct/2026:09:35:34 +0000] "HEAD / HTTP/1.1" 400 0 "-" "Mozilla/5.0 (compatible)" "-" edge="104.199.18.193" 104.199.18.193 - - [07/Oct/2026:09:35:35 +0000] "POST / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="104.199.18.193" 104.199.18.193 - - [07/Oct/2026:09:35:36 +0000] "OPTIONS / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="104.199.18.193" ... show less	Web Spam Web App Attack
🇹🇼 tye	2026-10-07 09:12:17 (1 week ago)	Wazuh Alert Evidence: 104.199.18.193 (104.199.18.193) - - [07/Oct/2026:17:12:14 +0800] "GNKT / HTTP/ ... show more Wazuh Alert Evidence: 104.199.18.193 (104.199.18.193) - - [07/Oct/2026:17:12:14 +0800] "GNKT / HTTP/1.1" 501 5236 "-" "Mozilla/5.0 (compatible)" show less	Web App Attack
Anonymous	2026-10-07 07:14:31 (1 week ago)	Web Attack HTTP OPTIONS Method	Web App Attack
🇳🇱 erwindecker	2026-10-07 06:40:09 (1 week ago)	[07/Oct/2026:08:40:08 +0200] 400 - GET http 195.240.146.102 "/" [Client 104.199.18.193] [Length 252] ... show more [07/Oct/2026:08:40:08 +0200] 400 - GET http 195.240.146.102 "/" [Client 104.199.18.193] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-" [07/Oct/2026:08:40:08 +0200] 400 - OPTIONS http 195.240.146.102 "/" [Client 104.199.18.193] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-" [07/Oct/2026:08:40:08 +0200] 400 - YXXF http 195.240.146.102 "/" [Client 104.199.18.193] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-" [07/Oct/2026:08:40:08 +0200] 400 - GET http 195.240.146.102 "/favicon.ico" [Client 104.199.18.193] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-" [07/Oct/2026:08:40:08 +0200] 400 - GET http 195.240.146.102 "/" [Client 104.199.18.193] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-" ... show less	Port Scan Bad Web Bot Web App Attack
🇫🇷 abuseipdb_reporter	2026-10-07 06:34:54 (1 week ago)	104.199.18.193 - - [07/Oct/2026:08:34:33 +0200] "07\xA0\x03\x02\x01`\xA100.0,\xA0\x04(NTLMSSP\x00\x ... show more 104.199.18.193 - - [07/Oct/2026:08:34:33 +0200] "07\xA0\x03\x02\x01`\xA100.0,\xA0\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-" 104.199.18.193 - - [07/Oct/2026:08:34:43 +0200] "0:\x02\x04b\x15\x1D>`2\x02\x01\x03\x04\x17cn=noqpevadqbtgenmgefib\x80\x14noqpevadqbtgenmgefib" 400 150 "-" "-" 104.199.18.193 - - [07/Oct/2026:08:34:53 +0200] "\x00\x00\x00C\x00\x12\x00\x00\x1E3\xF4\x81\x00\x1Fconsumer-Offset Explorer 2.2-18\x00\x12apache-kafka-java\x062.4.0\x00" 400 150 "-" "-" ... show less	Web App Attack
🇺🇸 withfallback.com	2026-10-07 06:30:42 (1 week ago)	Attempt to connect to Java debugger (JDWP)	Port Scan
🇧🇷 diego	2026-10-07 06:25:05 (1 week ago)	[probe-68-69] 2026-10-07 06:06:53, Client: 104.199.18.193, Protocol: 6, Unauthorized activity to HTT ... show more [probe-68-69] 2026-10-07 06:06:53, Client: 104.199.18.193, Protocol: 6, Unauthorized activity to HTTP: GET / show less	Web App Attack
🇱🇹 Selckie	2026-10-07 05:54:05 (1 week ago)	fail2ban: NGINX unusual impact	Web App Attack
🇨🇦 lakered	2026-10-07 05:47:45 (1 week ago)	Detectors: [NGINX, nginx_monitor] \| Reasons: Nginx: Default server trap hit \| Invalid HTTP protocol ... show more Detectors: [NGINX, nginx_monitor] \| Reasons: Nginx: Default server trap hit \| Invalid HTTP protocol or SSTP scan attempt detected on sinkhole \| Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f::64:0::mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 \| TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:32592m) show less	Port Scan Exploited Host
🇺🇸 HamSammich	2026-10-07 05:26:42 (1 week ago)	Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-10-07T05:26Z).	Brute-Force Web App Attack
🇺🇸 crooze.net	2026-10-07 05:22:38 (1 week ago)	104.199.18.193 - - [07/Oct/2026:01:22:37 -0400] "07\xA0\x03\x02\x01`\xA100.0,\xA0\x04(NTLMSSP\x00\x ... show more 104.199.18.193 - - [07/Oct/2026:01:22:37 -0400] "07\xA0\x03\x02\x01`\xA100.0,\xA0\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-" ... show less	Hacking Web App Attack
🇺🇸 gu-alvareza	2026-10-07 05:08:34 (1 week ago)	Java.Debug.Wire.Protocol.Insecure.Configuration	Hacking

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.227

🇵🇰 153.117.39.72

🇻🇳 103.200.23.154

🇳🇱 94.208.174.41

🇸🇦 82.167.193.214

🇰🇷 61.82.71.209

🇺🇸 188.212.143.205

🇩🇪 188.40.244.107

🇨🇳 183.56.216.153

🇫🇷 51.68.236.247

🇮🇳 49.207.182.187

🇳🇱 45.148.10.152

🇧🇪 35.240.100.200

🇹🇷 31.145.131.202

🇺🇸 216.244.66.249

🇺🇸 216.244.66.233

🇵🇱 194.180.49.53

🇸🇬 193.37.32.180

🇹🇷 188.119.22.252

🇩🇪 185.220.101.19