JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 136.64.36.130

136.64.36.130 was found in our database!

This IP was reported 41 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	130.36.64.136.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	Council Bluffs, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 136.64.36.130

Whois 136.64.36.130

IP Abuse Reports for 136.64.36.130:

This IP address has been reported a total of 41 times from 30 distinct sources. 136.64.36.130 was first reported on August 27th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-08-28 15:59:57 (2 hours ago)	Web vulnerability probing: /storage/logs/laravel.log	Web App Attack
Anonymous	2026-08-28 15:53:04 (2 hours ago)	Bot / scanning and/or hacking attempts: GET /env HTTP/1.1, GET /.env HTTP/1.1, GET /actuator/env HTT ... show more Bot / scanning and/or hacking attempts: GET /env HTTP/1.1, GET /.env HTTP/1.1, GET /actuator/env HTTP/1.1, GET /actuator/configprops HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1, GET /.env.production HTTP/1.1 show less	Hacking Web App Attack
🇩🇪 Lino Project	2026-08-28 14:45:23 (3 hours ago)	CrowdSec abuse IP report (host SRV-2) Scenario: crowdsecurity/http-sensitive-files	Hacking
🇺🇸 TPI-Abuse	2026-08-28 14:30:58 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 136.64.36.130 (130.36.64.136.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 136.64.36.130 (130.36.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 10:30:53.395393 2026] [security2:error] [pid 9036:tid 9150] [client 136.64.36.130:58998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nomadic-welshman.adetnw.com"] [uri "/.env.example"] [unique_id "apGbnX8T_1jh2zpYwfLLPwAAAQ8"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-08-28 14:08:42 (4 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-08-28 13:45:21 (4 hours ago)	URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ... show more URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-193) show less	Hacking
🇩🇪 LRob	2026-08-28 13:28:02 (5 hours ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /.env.backup (+12 more) \| 2026-08-28 13:28 UTC show less	Hacking Web App Attack
🇲🇾 Rizzy	2026-08-28 12:31:29 (6 hours ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇷🇺 russian-kurort.ru	2026-08-28 12:11:00 (6 hours ago)	SYN flood	DDoS Attack Hacking
🇬🇧 consul.to	2026-08-28 12:09:07 (6 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 JustMeHere	2026-08-28 12:04:30 (6 hours ago)	[Fri Aug 28 08:04:21.497745 2026] [security2:error] [pid 1313:tid 1343] [client 136.64.36.130:58900] ... show more [Fri Aug 28 08:04:21.497745 2026] [security2:error] [pid 1313:tid 1343] [client 136.64.36.130:58900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "c-73-88-79-72.hsd1.sc.comcast.net"] [uri "/.env.production"] [unique_id "apF5RR8uuhrrAdRVES7eNwAAAMI"] ... show less	Web App Attack
🇧🇬 Stoyko Stoykov	2026-08-27 22:23:52 (20 hours ago)	136.64.36.130 - - [28/Aug/2026:01:23:52 +0300] "GET /.env.production HTTP/1.1" 404 0 "-" "crusader-w ... show more 136.64.36.130 - - [28/Aug/2026:01:23:52 +0300] "GET /.env.production HTTP/1.1" 404 0 "-" "crusader-worker/1.0" ... show less	Hacking Web App Attack
🇳🇱 homeshowdomain.nl	2026-08-27 22:01:50 (20 hours ago)	Auto-ban: >3000 req/min op 2026-08-27	Web App Attack SSH Hacking
🇺🇸 JustMeHere	2026-08-27 21:28:09 (21 hours ago)	[Thu Aug 27 17:28:04.888020 2026] [security2:error] [pid 819:tid 957] [client 136.64.36.130:52882] M ... show more [Thu Aug 27 17:28:04.888020 2026] [security2:error] [pid 819:tid 957] [client 136.64.36.130:52882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "c-73-88-79-72.hsd1.sc.comcast.net"] [uri "/.env.backup"] [unique_id "apCr5EBD6ksei-zDjWsGHQAAAEk"] ... show less	Web App Attack
🇫🇮 Daniel Baer	2026-08-27 20:10:02 (22 hours ago)	CrowdSec local HTTP alert scenario: crowdsecurity/http-sensitive-files alert_id: 5345 events: 5 crea ... show more CrowdSec local HTTP alert scenario: crowdsecurity/http-sensitive-files alert_id: 5345 events: 5 created_at: 2026-08-27T20:06:15Z message: Ip 136.64.36.130 performed 'crowdsecurity/http-sensitive-files' (5 events over 1.856074ms) at 2026-08-27 20:06:14.276269898 +0000 UTC target_uri: ["/.env.backup","/.env.prod","/.env.local","/.env","/.env.dev"] method: ["GET"] status: ["301","404"] user_agent: ["crusader-worker/1.0"] show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 2a06:6440:0:2c3c::1

🇰🇷 211.223.107.86

🇧🇷 205.210.31.222

🇧🇷 205.210.31.219

🇦🇷 181.26.174.146

🇦🇷 181.26.69.171

🇳🇱 164.92.150.238

🇦🇺 3.106.165.254

🇩🇪 3.72.65.173

🇧🇷 205.210.31.216

🇧🇷 205.210.31.209

🇧🇷 187.57.131.55

🇦🇷 181.229.62.91

🇦🇷 181.23.140.246

🇺🇸 172.239.62.109

🇨🇳 106.4.161.4

🇺🇸 91.230.168.191

🇧🇭 88.201.31.190

🇷🇴 80.94.92.156

🇮🇳 66.116.224.33