JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.199.220.139

104.199.220.139 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 82%: ?

82%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	139.220.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇹🇼 Taiwan
City	Taipei, Taiwan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.199.220.139

Whois 104.199.220.139

IP Abuse Reports for 104.199.220.139:

This IP address has been reported a total of 20 times from 16 distinct sources. 104.199.220.139 was first reported on September 11th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 Domainhizmetleri.com	2026-09-14 15:37:48 (3 days ago)	Source: DH Hunter (Honeypot) \| Reason: Portscan (1 ports, 2 attempts in 480h)	Port Scan
🇺🇸 MPL	2026-09-13 21:39:43 (3 days ago)	tcp port scan (16 or more attempts)	Port Scan
🇧🇷 dermatovirtual	2026-09-13 18:44:08 (4 days ago)	Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ... show more Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 121 unauthorized requests recorded between 2026-09-12 18:41:35 UTC and 2026-09-12 18:42:03 UTC (rate: ~121 req/min). Edge perimeter firewall drop active. Log sample: [2026-09-12 18:42:00 UTC] IP: 104.199.220.139 - W3C IIS (Port 80): GET /actuator/mappings -> HTTP 500 [CLIENT: 104.199.220.139] [2026-09-12 18:42:00 UTC] IP: 104.199.220.139 - W3C IIS (Port 80): GET /actuator/httptrace -> HTTP 500 [CLIENT: 104.199.220.139] [2026-09-12 18:42:03 UTC] IP: 104.199.220.139 - W3C IIS (Port 80): GET /.env.copy -> HTTP 500 [CLIENT: 104.199.220.139] show less	Bad Web Bot Web App Attack
🇮🇪 AutosOnShow	2026-09-13 13:39:05 (4 days ago)	blocked for webapp attack \| path requested: / \| seen at 2026-09-13 13:38:27.750 \|	Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 12:49:58 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 104.199.220.139 (139.220.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.220.139 (139.220.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 08:49:53.619400 2026] [security2:error] [pid 8841:tid 8841] [client 104.199.220.139:5134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.137"] [uri "/media../.env"] [unique_id "aqab8Rk23Oit77gihyPrkAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-09-13 11:52:56 (4 days ago)	Blocked by UFW (TCP on 8443) Source port: 62576 TTL: 61 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 8443) Source port: 62576 TTL: 61 Packet length: 60 TOS: 0x00 This report (for 104.199.220.139) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-09-13 10:30:47 (4 days ago)	automatically banned	Brute-Force Web App Attack
🇭🇰 ncsr-sec	2026-09-13 05:37:04 (4 days ago)	Attacked NCSR.CN production server: SSH brute-force / web scanning / honeypot trips. fail2ban banned ... show more Attacked NCSR.CN production server: SSH brute-force / web scanning / honeypot trips. fail2ban banned. Evidence in server logs. show less	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-12 21:46:43 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 104.199.220.139 (139.220.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.220.139 (139.220.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 17:46:36.660192 2026] [security2:error] [pid 27872:tid 27872] [client 104.199.220.139:27612] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.158"] [uri "/static../.env"] [unique_id "aqXIPKVeccgEmZIdxGJ85QAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 oisecnet	2026-09-12 21:01:41 (4 days ago)	Automated report: Unauthorized vulnerability scanning detected on 2026-09-12. 296 requests from this ... show more Automated report: Unauthorized vulnerability scanning detected on 2026-09-12. 296 requests from this IP. show less	Port Scan Hacking Web App Attack
🇺🇸 MPL	2026-09-12 19:44:37 (4 days ago)	tcp port scan (16 or more attempts)	Port Scan
🇧🇷 dermatovirtual	2026-09-12 18:43:23 (5 days ago)	Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ... show more Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 115 unauthorized requests recorded between 2026-09-12 18:41:35 UTC and 2026-09-12 18:41:57 UTC (rate: ~115 req/min). Edge perimeter firewall drop active. Log sample: [2026-09-12 18:41:47 UTC] IP: 104.199.220.139 - W3C IIS (Port 80): GET /.env.test -> HTTP 500 [CLIENT: 104.199.220.139] [2026-09-12 18:41:50 UTC] IP: 104.199.220.139 - W3C IIS (Port 80): GET /aws/.env -> HTTP 500 [CLIENT: 104.199.220.139] [2026-09-12 18:41:50 UTC] IP: 104.199.220.139 - W3C IIS (Port 80): GET /aws/.env.production -> HTTP 500 [CLIENT: 104.199.220.139] show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-12 14:16:35 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 104.199.220.139 (139.220.199.104.bc.googleuserc ... show more (mod_security) mod_security (id:210492) triggered by 104.199.220.139 (139.220.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 10:16:30.139199 2026] [security2:error] [pid 10607:tid 10607] [client 104.199.220.139:34050] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.61"] [uri "/static../.env"] [unique_id "aqVevkhiDnWPqRHNv5fBPwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-12 12:04:54 (5 days ago)	Date: 2026/09/12 21 04 54 URI: http://121.184.2.116:8000/.env	Web App Attack
🇸🇪 KIDOS	2026-09-12 06:24:46 (5 days ago)	KASM auto: exploit_/.env.local	Brute-Force SSH

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.242.3.111

🇳🇱 91.92.40.49

🇺🇸 52.165.83.239

🇷🇴 2.57.122.209

🇷🇺 195.189.16.93

🇺🇦 188.163.92.242

🇧🇷 177.57.250.179

🇭🇰 152.32.254.222

🇦🇺 1.145.32.156

🇺🇸 2a03:2880:f802:2f::

🇮🇳 125.21.59.218

🇫🇷 91.196.152.167

🇳🇱 91.92.40.36

🇺🇸 50.16.30.200

🇺🇸 195.184.76.170

🇻🇪 131.72.170.2

🇧🇬 109.160.32.64

🇹🇷 94.154.43.223

🇷🇺 81.9.78.45

🇺🇸 47.89.225.243