JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.199.52.141

104.199.52.141 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	141.52.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.199.52.141

Whois 104.199.52.141

IP Abuse Reports for 104.199.52.141:

This IP address has been reported a total of 39 times from 27 distinct sources. 104.199.52.141 was first reported on August 31st 2026, and the most recent report was 52 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-09-01 13:51:46 (52 minutes ago)	[TueSep0115:51:39.7845492026][security2:error][pid70515:tid70622][client104.199.52.141:0]ModSecurity ... show more [TueSep0115:51:39.7845492026][security2:error][pid70515:tid70622][client104.199.52.141:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpanel.tpgs.ch\"][uri\"/.env.bak\"][unique_id\"apbYa3mWSZB0cPw0lbUd5QAAAMs\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 13:50:09 (54 minutes ago)	(mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:50:02.333627 2026] [security2:error] [pid 11208:tid 11208] [client 104.199.52.141:44412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.cyprus-boat-registration.com"] [uri "/.env.save"] [unique_id "apbYCnXfwrwE6p3tMNVRngAAADI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 debestelapp	2026-09-01 12:55:10 (1 hour ago)		Web App Attack
🇳🇱 MyGlobalFlowers	2026-09-01 12:36:47 (2 hours ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 10:56:29 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:56:26.090947 2026] [security2:error] [pid 11802:tid 11802] [client 104.199.52.141:55904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.alphatar.io"] [uri "/.env.bak"] [unique_id "apavWtec235gcUQt98F7rAAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 10:22:07 (4 hours ago)	Bot / scanning and/or hacking attempts: GET /.env.backup HTTP/1.1, GET /.env.production HTTP/1.1, GE ... show more Bot / scanning and/or hacking attempts: GET /.env.backup HTTP/1.1, GET /.env.production HTTP/1.1, GET /actuator/env HTTP/1.1, GET /wp-config.php.swp HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /.env HTTP/1.1, GET /.env.example HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /env HTTP/1.1 show less	Hacking Web App Attack
🇬🇧 Aetherweb Ark	2026-09-01 10:11:59 (4 hours ago)	(mod_security) mod_security (id:949110) triggered by 104.199.52.141 (BE/Belgium/141.52.199.104.bc.go ... show more (mod_security) mod_security (id:949110) triggered by 104.199.52.141 (BE/Belgium/141.52.199.104.bc.googleusercontent.com): N in the last X secs show less	Web App Attack
Anonymous	2026-09-01 10:06:12 (4 hours ago)	Bot / seems abusive / Apache connections: 44	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-09-01 09:42:27 (5 hours ago)	Repeated requests for suspicious nonexistent URLs, for example: /.env.example (HTTP port 443)	Web App Attack
🇧🇾 lns.bz	2026-09-01 07:44:16 (7 hours ago)	.env scanning [BY]	Web App Attack
🇩🇪 Hazzard	2026-09-01 07:13:05 (7 hours ago)	(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)	SQL Injection
🇵🇱 Budyn	2026-09-01 06:44:03 (8 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.online \| URI: /actuator/configprops \| UA: crusader-worker/1.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-09-01 06:37:16 (8 hours ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 06:23:53 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:23:49.262638 2026] [security2:error] [pid 24737:tid 24737] [client 104.199.52.141:48200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.advantageinvestigation.com"] [uri "/wp-config.php.swp"] [unique_id "apZvdaewjiJnT7I63tHNEAAAAHE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 06:07:04 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 104.199.52.141 (141.52.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:06:58.731856 2026] [security2:error] [pid 12780:tid 12780] [client 104.199.52.141:45578] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.aksaltwatercharters.com"] [uri "/.env.bak"] [unique_id "apZrgv5Luhy564tPhUWscAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 45.131.193.12

🇸🇰 178.41.71.241

🇨🇳 171.44.228.7

🇮🇳 118.91.235.28

🇦🇪 94.202.13.224

🇺🇸 64.227.55.154

🇧🇷 187.18.8.5

🇺🇸 172.236.228.222

🇺🇸 172.208.13.57

🇹🇼 125.229.151.234

🇨🇳 101.71.37.145

🇷🇺 77.88.47.10

🇰🇷 220.124.226.145

🇳🇱 195.178.110.22

🇳🇱 185.93.89.23

🇺🇸 20.83.173.53

🇨🇳 221.213.129.46

🇨🇳 218.23.95.14

🇹🇭 125.25.205.75

🇨🇳 116.113.241.82