JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.138.159.239

34.138.159.239

Recent Activity

54 reports found in our database

100% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

Google LLC

Usage Type

Data Center/Web Hosting/Transit

ASN

AS396982

Hostname(s)

239.159.138.34.bc.googleusercontent.com

Domain Name

google.com

Country

🇺🇸 United States of America

City

North Charleston, South Carolina

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 34.138.159.239:

This IP address has been reported a total of 54 times from 38 distinct sources. 34.138.159.239 was first reported on September 3rd 2026, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: United States of America with 15 reports; Netherlands with 10 reports; Germany with 6 reports. The most common categories in these recent reports were: Web App Attack 44 times; Brute-Force 29 times; Bad Web Bot 23 times; Hacking 12 times; Exploited Host 1 time; Other 3 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-04 22:02:47 (1 day ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-03. show less	Web App Attack SSH Hacking
Anonymous	2026-09-04 16:16:36 (1 day ago)	$f2bV_matches	Brute-Force Web App Attack
🇵🇱 sefinek.net	2026-09-04 15:43:00 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (POST) \| Endpo ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/1.1 (POST) \| Endpoint: /api \| UA: Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot) Chrome/136.0.1115.44 Mobile Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇳🇱 MacLotsen	2026-09-04 15:00:21 (1 day ago)	[Fri Sep 04 17:00:05.882959 2026] [php7:error] [pid 1058266] [client 34.138.159.239:9682] script '/v ... show more [Fri Sep 04 17:00:05.882959 2026] [php7:error] [pid 1058266] [client 34.138.159.239:9682] script '/var/www/degastrobar.nl/config.php' not found or unable to stat [Fri Sep 04 17:00:20.577143 2026] [php7:error] [pid 1058357] [client 34.138.159.239:25144] script '/var/www/degastrobar.nl/i.php' not found or unable to stat [Fri Sep 04 17:00:20.584815 2026] [php7:error] [pid 1058032] [client 34.138.159.239:25146] script '/var/www/degastrobar.nl/pi.php' not found or unable to stat ... show less	Web App Attack Brute-Force
🇮🇩 sockominfo	2026-09-04 13:00:29 (1 day ago)	Reported by TangerangKota-CSIRT. Status: MALICIOUS	Hacking Brute-Force
🇳🇱 debestelapp	2026-09-04 12:30:11 (1 day ago)		Web App Attack
🇮🇩 sockominfo	2026-09-04 12:00:09 (1 day ago)	Access to sensitive configuration files detected (Success: 200).. Threat Score: 7/10 (MEDIUM). Repor ... show more Access to sensitive configuration files detected (Success: 200).. Threat Score: 7/10 (MEDIUM). Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-04 11:53:23 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 34.138.159.239 (239.159.138.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.138.159.239 (239.159.138.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:53:19.626438 2026] [security2:error] [pid 26179:tid 26179] [client 34.138.159.239:54212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "agirlwithaguitar.misscharlottemusic.com"] [uri "/@fs/.env"] [unique_id "apqxL4TYNQXhabmiAMZpcQAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-04 11:11:01 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 34.138.159.239 (239.159.138.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.138.159.239 (239.159.138.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:10:57.600543 2026] [security2:error] [pid 18176:tid 18176] [client 34.138.159.239:4036] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.perlcreativedesign.com"] [uri "/@fs/src/.env"] [unique_id "apqnQXKmrLNhAc1_n9vM9gAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-04 09:55:16 (1 day ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 34.138.159.239 (US/United States/239.159.138.3 ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 34.138.159.239 (US/United States/239.159.138.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇪🇸 librebit	2026-09-04 09:43:27 (1 day ago)	Bad guys doing bad things, bad crawling	Bad Web Bot
🇩🇪 abuse-detection	2026-09-04 09:25:57 (1 day ago)	Web security detection (http-sensitive-probe); path=/@fs/root/.ssh/id_ed25519; status=404	Hacking Web App Attack
🇳🇱 Site.eu	2026-09-04 06:40:32 (2 days ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 TPI-Abuse	2026-09-04 05:50:08 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 34.138.159.239 (239.159.138.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.138.159.239 (239.159.138.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 01:50:00.885257 2026] [security2:error] [pid 27901:tid 27901] [client 34.138.159.239:33890] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.custombusinessgreetingcards.com"] [uri "/@fs/app/.env"] [unique_id "appcCHys6n73CXyJmvD4IAAAAD4"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 openstrike.co.uk	2026-09-04 05:14:30 (2 days ago)	242 attacks on site downloads, password grabbing URLs, directory traversals, VC URLs, config grabbin ... show more 242 attacks on site downloads, password grabbing URLs, directory traversals, VC URLs, config grabbing URLs (type 2), PHP URLs, env grabbing URLs: GET /backup.sql HTTP/1.1 GET /_next/../.aws/credentials HTTP/1.1 GET /..;/..;/.azure/credentials HTTP/1.1 GET /.git/HEAD HTTP/1.1 GET /config/gcp.json HTTP/1.1 GET /phpinfo.php HTTP/1.1 GET /static/.env HTTP/1.1 show less	Hacking Web App Attack

Showing 1 to 15 of 54 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 147.185.133.2

🇺🇸 136.109.151.63

🇧🇷 205.210.31.253

🇺🇸 173.194.103.87

🇪🇸 172.68.134.216

🇸🇬 101.47.16.103

🇳🇱 91.92.42.177

🇺🇸 64.23.239.161

🇩🇴 45.172.152.74

🇺🇸 40.125.42.10

🇺🇸 40.124.171.21

🇮🇳 38.137.43.248

🇧🇷 205.210.31.177

🇺🇸 205.210.31.14

🇨🇳 182.119.225.105

🇺🇸 172.253.8.157

🇫🇮 147.185.133.155

🇺🇿 144.124.192.112

🇫🇮 89.125.113.149

🇺🇸 74.244.21.217