JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.199.52.254

104.199.52.254 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	254.52.199.104.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.199.52.254

Whois 104.199.52.254

IP Abuse Reports for 104.199.52.254:

This IP address has been reported a total of 24 times from 22 distinct sources. 104.199.52.254 was first reported on August 5th 2026, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 lostswordfish.com	2026-09-17 16:04:03 (18 hours ago)	Wordfence waf block on jestrellafoundation	Web App Attack
🇧🇾 lns.bz	2026-09-17 15:59:44 (18 hours ago)	Too many 404 requests [BY]	Web App Attack
🇫🇮 as211431.net	2026-09-17 15:58:17 (18 hours ago)	Triggered Cloudflare WAF (firewallCustom) from BE. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from BE. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: //cms/wp-includes/wlwmanifest.xml UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 integrantservices.com	2026-09-17 15:55:15 (18 hours ago)	(wordpress) Failed wordpress login from 104.199.52.254 (BE/Belgium/254.52.199.104.bc.googleuserconte ... show more (wordpress) Failed wordpress login from 104.199.52.254 (BE/Belgium/254.52.199.104.bc.googleusercontent.com) show less	Brute-Force
🇩🇪 ghostwarriors	2026-09-17 15:50:10 (18 hours ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 15:41:38 (18 hours ago)	(mod_security) mod_security (id:225170) triggered by 104.199.52.254 (254.52.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:225170) triggered by 104.199.52.254 (254.52.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 11:41:31.873603 2026] [security2:error] [pid 28249:tid 28249] [client 104.199.52.254:53274] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.jeremyscraig.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.jeremyscraig.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqwKK-jpfD1WJgJAufOEnQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 yitzhaq	2026-09-17 15:40:45 (18 hours ago)	104.199.52.254 - - [17/Sep/2026:17:40:41 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 426 ... show more 104.199.52.254 - - [17/Sep/2026:17:40:41 +0200] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 404 4264 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.199.52.254 - - [17/Sep/2026:17:40:41 +0200] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 4265 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.199.52.254 - - [17/Sep/2026:17:40:41 +0200] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.199.52.254 - - [17/Sep/2026:17:40:41 +0200] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 516 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" 104.199.52.254 - - [17/Sep/2026:17:40:41 +0200] "GET //website/wp-includes/wlwmanifest. show less	Web App Attack Hacking
🇵🇱 Budyn	2026-09-17 15:38:55 (18 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: jenkins.goblinpot.website \| URI: //xmlrpc.php?rsd \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇳🇴 Bots.go.to.hell	2026-09-17 15:36:26 (18 hours ago)	This IP was detected by CrowdSec triggering custom/ip-honeypot	Web App Attack Bad Web Bot
🇳🇱 ipoac.nl	2026-09-17 15:36:18 (18 hours ago)	-.nl:443 104.199.52.254 - - [17/Sep/2026:17:36:17 +0200] -.nl "GET //wp-includes/wlwmanifest.xml HTT ... show more -.nl:443 104.199.52.254 - - [17/Sep/2026:17:36:17 +0200] -.nl "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 403 1972 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" show less	Bad Web Bot
Anonymous	2026-09-17 15:34:19 (19 hours ago)	[Thu Sep 17 17:34:19.368797 2026] [access_compat:error] [pid 1127137:tid 1127137] [client 104.199.52 ... show more [Thu Sep 17 17:34:19.368797 2026] [access_compat:error] [pid 1127137:tid 1127137] [client 104.199.52.254:59396] AH01797: client denied by server configuration: /var/www/html/wp-includes [Thu Sep 17 17:34:19.627742 2026] [access_compat:error] [pid 1127137:tid 1127137] [client 104.199.52.254:59396] AH01797: client denied by server configuration: /var/www/html/blog ... show less	Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-09-17 15:28:59 (19 hours ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-09-17 15:22:02 (19 hours ago)	(wordpress) Failed wordpress login from 104.199.52.254 (BE/Belgium/Brussels Capital/Brussels/254.52. ... show more (wordpress) Failed wordpress login from 104.199.52.254 (BE/Belgium/Brussels Capital/Brussels/254.52.199.104.bc.googleusercontent.com/[redacted]) show less	Brute-Force
🇺🇸 HJ5Ss4Ju	2026-09-17 15:17:13 (19 hours ago)	Wordfence firewall block	Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 15:07:35 (19 hours ago)	(mod_security) mod_security (id:225170) triggered by 104.199.52.254 (254.52.199.104.bc.googleusercon ... show more (mod_security) mod_security (id:225170) triggered by 104.199.52.254 (254.52.199.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 11:07:29.334842 2026] [security2:error] [pid 29606:tid 29606] [client 104.199.52.254:51227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.j3pr.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.j3pr.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqwCMapYg5FgNFhCMwxPFwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.87.32.78

🇧🇷 189.127.19.28

🇻🇳 123.25.115.189

🇺🇸 52.173.67.116

🇭🇰 223.18.201.43

🇩🇪 213.209.159.108

🇺🇸 209.37.38.210

🇭🇰 202.155.236.242

🇺🇸 170.187.154.22

🇩🇪 167.99.241.118

🇺🇸 162.216.150.228

🇭🇰 156.225.1.108

🇫🇷 138.199.16.131

🇨🇳 106.4.161.154

🇧🇦 89.117.46.54

🇰🇿 87.121.125.18

🇫🇷 85.217.140.45

🇧🇬 79.124.58.18

🇺🇦 77.109.21.190

🇲🇾 47.254.192.136