JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.211.55.221

130.211.55.221 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	221.55.211.130.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.211.55.221

Whois 130.211.55.221

IP Abuse Reports for 130.211.55.221:

This IP address has been reported a total of 44 times from 42 distinct sources. 130.211.55.221 was first reported on October 16th 2026, and the most recent report was 1 minute ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 SOC [GOLINE SA]	2026-10-16 15:47:02 (1 minute ago)	[RoutePulse \| 2026-10-16T15:47:02Z \| RTBH-INJECTED] ATTACK CLASS: mail_correlation SOURCE: 130.211.5 ... show more [RoutePulse \| 2026-10-16T15:47:02Z \| RTBH-INJECTED] ATTACK CLASS: mail_correlation SOURCE: 130.211.55.221 (221.55.211.130.bc.googleusercontent.com) · AS396982 Google LLC · Belgium EVIDENCE: Mail correlation auto: score 92, belief 0.67, behaviour + target + identity, phases recon — LoadMaster posture: attack 100/100 — hit-and-run, autodiscover-enum, burst; AbuseIPDB confidence 100 % (28 reports, Data Center/Web Hosting/Transit) DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring ACTION: BGP null route injected at RoutePulse network edge show less	Hacking
🇳🇱 e.fierstra	2026-10-16 15:46:21 (2 minutes ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇦🇺 aranguren.org	2026-10-16 15:43:12 (5 minutes ago)	130.211.55.221 - - [17/Oct/2026:02:43:11 +1100] "GET /.git/config HTTP/2.0" 301 281 "-" "Mozilla/5.0 ... show more 130.211.55.221 - - [17/Oct/2026:02:43:11 +1100] "GET /.git/config HTTP/2.0" 301 281 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384 130.211.55.221 - - [17/Oct/2026:02:43:11 +1100] "GET /.git/config HTTP/2.0" 301 281 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" TLSv1.3 TLS_AES_256_GCM_SHA384 ... show less	Web App Attack
🇪🇸 loadsoporte	2026-10-16 15:40:43 (7 minutes ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
Anonymous	2026-10-16 15:30:24 (18 minutes ago)	CrowdSec blocked IP for crowdsecurity/http-sensitive-files on vps_agent	Web App Attack
🇺🇸 TPI-Abuse	2026-10-16 15:30:09 (18 minutes ago)	(mod_security) mod_security (id:210492) triggered by 130.211.55.221 (221.55.211.130.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 130.211.55.221 (221.55.211.130.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 11:29:57.983061 2026] [security2:error] [pid 16236:tid 16236] [client 130.211.55.221:54070] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.koreasesame.com"] [uri "/.env-example"] [unique_id "atJC9RbMpZ0GGH0DWm3IugAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 eagle	2026-10-16 15:28:32 (19 minutes ago)	130.211.55.221 - - [16/Oct/2026:15:28:31 +0000] "GET / HTTP/1.1" 404 554 "-" "Mozilla/5.0 (Windows N ... show more 130.211.55.221 - - [16/Oct/2026:15:28:31 +0000] "GET / HTTP/1.1" 404 554 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" "autodiscover.klondike.dk" 130.211.55.221 - - [16/Oct/2026:15:28:32 +0000] "GET /.aws/.env HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "autodiscover.klondike.dk" 130.211.55.221 - - [16/Oct/2026:15:28:32 +0000] "GET /.amplifyrc HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "autodiscover.klondike.dk" 130.211.55.221 - - [16/Oct/2026:15:28:32 +0000] "GET /.aws/credentials HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "autodiscover.klondike.dk" 130.211.55.221 - - [16/Oct/2026:15:28:32 +0000] "GET /.aws/config HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "autodiscover.klondike.dk" 130.211.55.221 - - [16/Oct/2026:15:28:32 +0000] "GET /.aws/credentia ... show less	Bad Web Bot Web App Attack
🇸🇰 KSBA	2026-10-16 15:28:14 (20 minutes ago)	Automatic report from KSBA firewall log.	Port Scan Hacking Brute-Force
🇩🇪 TheDjRider	2026-10-16 15:23:24 (25 minutes ago)	CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban tri ... show more CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban triggered. Detection time (UTC): 2026-10-16T15:23:22.665157895Z. Context: http_status=404, http_status=403 show less	Web App Attack
🇺🇸 iwle	2026-10-16 15:15:50 (32 minutes ago)	[Fri Oct 16 11:15:47.947113 2026] [:error] [pid 1586:tid 1739] [client 130.211.55.221:0] [client 130 ... show more [Fri Oct 16 11:15:47.947113 2026] [:error] [pid 1586:tid 1739] [client 130.211.55.221:0] [client 130.211.55.221] ModSecurity: Warning. Matched phrase ".aws/config" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autodiscover.iwle.com"] [uri "/.aws/config"] [unique_id "atI_oySTNkUNGmukAXbQmQAAAEI"] [Fri Oct 16 11:15:48.267449 2026] [:error] [pid 1616:tid 1736] [client 130.211.55.221:0] [client 130.211.55.221] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APP ... show less	Web App Attack Brute-Force
🇩🇪 Nightreaver	2026-10-16 15:14:01 (34 minutes ago)	130.211.55.221 - - [16/Oct/2026:17:14:00 0200] "GET /.amplifyrc HTTP/1.1" 404 1053 "-" "Mozilla/5.0 ... show more 130.211.55.221 - - [16/Oct/2026:17:14:00 0200] "GET /.amplifyrc HTTP/1.1" 404 1053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 130.211.55.221 - - [16/Oct/2026:17:14:00 0200] "GET /.aws/config HTTP/1.1" 404 1053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 130.211.55.221 - - [16/Oct/2026:17:14:00 0200] "GET /.aws/credentials HTTP/1.1" 404 1053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 130.211.55.221 - - [16/Oct/2026:17:14:00 0200] "GET /.aws/credentials.bak HTTP/1.1" 404 1053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 130.211.55.221 - - [16/Oct/2026:17:14:00 0200] "GET /.claude/settings.local.json HTTP/1.1" 404 1053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"[...] show less	Bad Web Bot Web App Attack
🇺🇸 LSPCCU	2026-10-16 15:12:35 (35 minutes ago)	TSEC Honeypot Network report. Threat score: 68/100. Categories: DDoS Attack, Port Scan, Hacking, Bru ... show more TSEC Honeypot Network report. Threat score: 68/100. Categories: DDoS Attack, Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: 130.211.55.221 classified as botnet node participating in coordinated attack campaigns (high confidence). show less	DDoS Attack Port Scan Hacking Brute-Force Web App Attack SSH
🇺🇸 dot.mg	2026-10-16 15:08:18 (40 minutes ago)	Scan of vulnerable files	Web App Attack
🇭🇷 IgorS.zg.hr	2026-10-16 15:07:31 (40 minutes ago)	Web application attack detected by fail2ban	Hacking Web App Attack
🇳🇱 i-turnradio.nl	2026-10-16 15:05:41 (42 minutes ago)	2026-10-16 @ 17:05:38 (CET) ~ Blocked for trying to access: /.amplifyrc	Web App Attack

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 192.155.90.220

🇮🇳 106.215.136.167

🇧🇩 103.108.91.226

🇦🇷 45.178.195.205

🇷🇴 2.57.122.238

🇵🇭 222.126.105.187

🇺🇸 155.212.111.102

🇸🇬 116.193.85.70

🇩🇪 94.130.226.243

🇪🇸 86.127.236.127

🇵🇱 77.91.65.122

🇺🇸 77.73.14.137

🇺🇸 20.65.179.159

🇻🇳 210.86.226.51

🇳🇱 195.178.110.228

🇮🇳 103.70.40.36

🇺🇸 96.78.175.36

🇺🇦 91.239.233.228

🇮🇷 87.107.129.28

🇨🇦 85.217.149.43