JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.199.45.220

104.199.45.220 was found in our database!

This IP was reported 62 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	220.45.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.199.45.220

Whois 104.199.45.220

IP Abuse Reports for 104.199.45.220:

This IP address has been reported a total of 62 times from 42 distinct sources. 104.199.45.220 was first reported on September 11th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 eposs-it.de	2026-09-14 11:05:09 (2 days ago)	Blocked by os-abuseipdb; 8 hits, proto=tcp, ports=443,80	Port Scan Hacking
Anonymous	2026-09-14 08:05:18 (3 days ago)	104.199.45.220 - - [14/Sep/2026:10:05:17 +0200] "GET /.git-credentials HTTP/2.0" 301 169 "-" "Mozill ... show more 104.199.45.220 - - [14/Sep/2026:10:05:17 +0200] "GET /.git-credentials HTTP/2.0" 301 169 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https:///support/amazonbot)" show less	Bad Web Bot
🇮🇳 evicky2002	2026-09-14 06:00:01 (3 days ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇳🇱 WeCloudit-Anti-Abuse	2026-09-14 02:30:21 (3 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing	Web App Attack Hacking
🇫🇷 dwmp	2026-09-13 21:54:05 (3 days ago)	Url probing: /__/firebase/init.json	Web App Attack
🇳🇱 middelkoopcc	2026-09-13 14:38:00 (3 days ago)	2026-09-13 16:36:00 GET /settings.json [301] && 2026-09-13 16:36:01 GET /__/firebase/init.json [301] ... show more 2026-09-13 16:36:00 GET /settings.json [301] && 2026-09-13 16:36:01 GET /__/firebase/init.json [301] && 2026-09-13 16:36:01 GET /.git-credentials [301] && 183 more within 20 minutes show less	Web App Attack
Anonymous	2026-09-13 13:20:02 (3 days ago)	\| Multiple common web attacks from same source ip. (multiple servers)	Web App Attack Hacking SQL Injection
🇦🇺 paulshipley.com.au	2026-09-13 11:16:11 (3 days ago)	[Sun Sep 13 21:16:11.513093 2026] [security2:error] [pid 896096] [client 104.199.45.220:40980] [clie ... show more [Sun Sep 13 21:16:11.513093 2026] [security2:error] [pid 896096] [client 104.199.45.220:40980] [client 104.199.45.220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.info"] [uri "/.aws/config"] [unique_id "aqaF-wKvwJ3RM3oxNVK1owAAAA0"] ... show less	Web App Attack
Anonymous	2026-09-13 10:57:38 (3 days ago)	[Sun Sep 13 12:57:35.645629 2026] [access_compat:error] [pid 1424525:tid 1424525] [client 104.199.45 ... show more [Sun Sep 13 12:57:35.645629 2026] [access_compat:error] [pid 1424525:tid 1424525] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/rclone.conf, referer: https://loretlargent.info/rclone.conf [Sun Sep 13 12:57:35.659769 2026] [access_compat:error] [pid 1424059:tid 1424059] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.aws, referer: https://loretlargent.info/.aws/config [Sun Sep 13 12:57:35.668544 2026] [access_compat:error] [pid 1423481:tid 1423481] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.aws, referer: https://loretlargent.info/.aws/credentials [Sun Sep 13 12:57:36.531302 2026] [access_compat:error] [pid 1423323:tid 1423323] [client 104.199.45.220:0] AH01797: client denied by server configuration: /var/www/wordpress/loretlargent.info/.docker, referer: https://loretlargent.info/.docker/confi ... show less	Web Spam Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 10:56:51 (3 days ago)	(mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 06:56:43.607497 2026] [security2:error] [pid 24525:tid 24525] [client 104.199.45.220:46972] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|londongroup.info\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "londongroup.info"] [uri "/rclone.conf"] [unique_id "aqaBa4SjHeNMrUkRYd7osQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-13 10:43:58 (3 days ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /dist/manifest.json (+6 more) \| 2026-09-13 10:43 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 10:18:43 (3 days ago)	(mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 104.199.45.220 (220.45.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 06:18:38.575941 2026] [security2:error] [pid 10236:tid 10236] [client 104.199.45.220:48120] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|keystroke.info\|F\|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystroke.info"] [uri "/LocalSettings.php.backup"] [unique_id "aqZ4fu6IHX41PT3F8BRMZQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-09-13 10:01:59 (3 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 104.199.45.220 (BE/Belgium/220.45.199.10 ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 104.199.45.220 (BE/Belgium/220.45.199.104.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.199.45.220 - - [13/Sep/2026:12:01:57 +0200] "GET /.ssh/id_dsa HTTP/2.0" 200 12141 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)" "-" host=johnfante.info show less	Port Scan
🇳🇱 debestelapp	2026-09-13 10:00:11 (3 days ago)		Web App Attack
Anonymous	2026-09-13 09:42:01 (3 days ago)	Bot / scanning and/or hacking attempts: GET /server-info HTTP/2.0, GET /pi.php HTTP/2.0, GET /elmah. ... show more Bot / scanning and/or hacking attempts: GET /server-info HTTP/2.0, GET /pi.php HTTP/2.0, GET /elmah.axd HTTP/2.0, GET /info.php HTTP/2.0, GET /nginx_status HTTP/2.0, POST /read-document HTTP/2.0, GET /actuator/loggers HTTP/2.0, DELETE /api/inngest HTTP/2.0, GET /_profiler/open HTTP/2.0, GET /_debugbar/open HTTP/2.0, GET /app_dev.php/_profiler HTTP/2.0, GET /__debug__/ HTTP/2.0, GET /actuator/mappings HTTP/2.0, GET /phpinfo.php HTTP/2.0, POST /api/v1/validate/code HTTP/2.0, POST /api HTTP/2.0, POST /api/fs/exec HTTP/2.0, POST /mcp HTTP/2.0, GET /i.php HTTP/2.0, GET /_ignition/health-check HTTP/2.0, GET /app_dev.php HTTP/2.0, GET /trace.axd HTTP/2.0, GET /test.php HTTP/2.0, DELETE /inngest HTTP/2.0 show less	Hacking Web App Attack

Showing 1 to 15 of 62 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 177.229.197.38

🇪🇸 172.68.135.167

🇳🇱 91.92.42.29

🇩🇪 69.5.169.101

🇭🇰 43.132.154.187

🇹🇿 41.93.28.9

🇺🇸 205.210.31.51

🇺🇸 162.216.150.69

🇳🇱 160.119.76.138

🇨🇳 123.168.148.48

🇻🇳 123.30.238.247

🇻🇳 103.28.37.12

🇺🇸 66.132.186.132

🇦🇷 38.7.36.100

🇧🇷 37.148.132.205

🇦🇺 34.40.217.81

🇺🇸 2604:a940:301:225:0:18::

🇳🇱 176.65.148.226

🇺🇸 136.111.136.160

🇨🇳 116.179.32.105