JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.104.156.39

34.104.156.39 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 98%: ?

98%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	39.156.104.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.104.156.39

Whois 34.104.156.39

IP Abuse Reports for 34.104.156.39:

This IP address has been reported a total of 28 times from 17 distinct sources. 34.104.156.39 was first reported on August 31st 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 consul.to	2026-09-01 13:53:00 (7 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 13:46:28 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:46:23.268480 2026] [security2:error] [pid 26757:tid 26757] [client 34.104.156.39:44354] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crystaljohns.com.my-spec.com"] [uri "/.env.bak"] [unique_id "apbXL4ZCsQhvQm5BM93qVwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 debestelapp	2026-09-01 13:15:09 (8 hours ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 12:55:59 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:55:52.184557 2026] [security2:error] [pid 15891:tid 15891] [client 34.104.156.39:38526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "posta.semisysteme.com"] [uri "/.env"] [unique_id "apbLWL7EYjhEfaWHvCLCuAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 10:56:03 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:55:58.298931 2026] [security2:error] [pid 11874:tid 11874] [client 34.104.156.39:40288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.utah17.com"] [uri "/.env"] [unique_id "apavPg6RIWgognAcYGp5pQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TAY	2026-09-01 10:18:16 (11 hours ago)	34.104.156.39 - - [01/Sep/2026:18:18:12 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 449 "-" "crusad ... show more 34.104.156.39 - - [01/Sep/2026:18:18:12 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 449 "-" "crusader-worker/1.0" 34.104.156.39 - - [01/Sep/2026:18:18:13 +0800] "GET /wp-config.php~ HTTP/1.1" 301 443 "-" "crusader-worker/1.0" 34.104.156.39 - - [01/Sep/2026:18:18:13 +0800] "GET /wp-config.php.swp HTTP/1.1" 301 449 "-" "crusader-worker/1.0" 34.104.156.39 - - [01/Sep/2026:18:18:09 +0800] "GET /wp-config.php.swp HTTP/1.1" 404 55969 "-" "crusader-worker/1.0" 34.104.156.39 - - [01/Sep/2026:18:18:09 +0800] "GET /wp-config.php.bak HTTP/1.1" 404 55969 "-" "crusader-worker/1.0" 34.104.156.39 - - [01/Sep/2026:18:18:09 +0800] "GET /wp-config.php~ HTTP/1.1" 404 55969 "-" "crusader-worker/1.0" ... show less	Brute-Force
Anonymous	2026-09-01 10:15:57 (11 hours ago)	34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env HTTP/1.1" 403 199 "-" "crusader-worker/1.0 ... show more 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.prod HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.save HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.old HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.production HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.dev HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.example HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026:05:15:56 -0500] "GET /.env.bak HTTP/1.1" 403 199 "-" "crusader-worker/1.0" 34.104.156.39 34.104.156.39 - - [01/Sep/2026: ... show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 09:51:31 (11 hours ago)	Web App Attack	Brute-Force Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 09:35:05 (12 hours ago)	(mod_security) mod_security (id:210730) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210730) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:34:56.404214 2026] [security2:error] [pid 20084:tid 20134] [client 34.104.156.39:33208] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|smtp01.absurdotron.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "smtp01.absurdotron.com"] [uri "/storage/logs/laravel.log"] [unique_id "apacQOlg42CGBgLAd2WphAAAANA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 07:49:22 (13 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 03:49:16.916227 2026] [security2:error] [pid 1867:tid 1867] [client 34.104.156.39:43224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.davidocchino.com"] [uri "/.env"] [unique_id "apaDfCvMQ7Z293kcd1CtFQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-01 06:08:14 (15 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-09-01 06:06:20 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:06:14.153511 2026] [security2:error] [pid 23272:tid 23272] [client 34.104.156.39:46592] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.cycontechnology.com"] [uri "/.env.dev"] [unique_id "apZrVosw6K7zgoH2mR8tlAAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-09-01 06:03:49 (15 hours ago)	[TueSep0108:03:43.7249622026][security2:error][pid3753484:tid3753576][client34.104.156.39:0]ModSecur ... show more [TueSep0108:03:43.7249622026][security2:error][pid3753484:tid3753576][client34.104.156.39:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpanel.safeoncloud.ch\"][uri\"/.env.old\"][unique_id\"apZqvwMAXXifvAWTdLxewgAAAQg\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 05:33:10 (16 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.104.156.39 (39.156.104.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 01:33:03.390373 2026] [security2:error] [pid 27830:tid 27830] [client 34.104.156.39:45608] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ticmatopografiaeingenieria.com"] [uri "/.env.local"] [unique_id "apZjj3rqrJBJjPRLSiyM3wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 conure.sh	2026-09-01 04:44:53 (16 hours ago)	csagent: score 20.5: 404 noise floor x2, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0 ... show more csagent: score 20.5: 404 noise floor x2, wp-config backup grab x1, secrets grab x1; 1 domain(s) in 0s show less	Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇾 47.250.174.4

🇬🇧 5.226.140.17

🇰🇷 218.52.254.90

🇹🇼 198.235.24.49

🇳🇱 195.178.110.60

🇵🇱 194.180.48.39

🇲🇽 158.23.18.78

🇧🇷 147.93.14.7

🇮🇳 117.211.77.184

🇸🇬 103.187.147.71

🇺🇸 47.251.78.84

🇺🇸 5.161.73.167

🇺🇸 4.148.17.19

🇮🇷 217.60.255.130

🇳🇷 203.98.225.11

🇮🇱 35.252.1.100

🇺🇸 104.220.35.174

🇺🇸 66.132.172.214

🇵🇪 190.119.63.98

🇷🇺 178.70.137.86