JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

34.139.12.221

Neutral Activity

Abuse confidence score ?

0% Low Risk

14 reports

13 reporters · latest 2 months ago

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	221.12.139.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	North Charleston, South Carolina

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

34.139.12.221 has been reported 14 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 34.139.12.221

Export CSV

This IP address has been reported a total of 14 times from 13 distinct sources. 34.139.12.221 was first reported on August 18th 2026, and the most recent report was 2 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-18 10:52:21 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 34.139.12.221 (221.12.139.34.bc.googleuserconte ... show more (mod_security) mod_security (id:225170) triggered by 34.139.12.221 (221.12.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 06:52:14.467936 2026] [security2:error] [pid 11813:tid 11813] [client 34.139.12.221:57125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.energycapitalinvestments.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.energycapitalinvestments.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aoQ5XmIgjdQ2ozx1hmTl3wAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 WizardsToolkit	2026-08-18 10:46:18 (2 months ago)	tried to access forbidden files; attempted to access /blog/wp-includes/wlwmanifest.xml	Web App Attack
🇳🇱 Savvii	2026-08-18 10:42:42 (2 months ago)	10 attempts against mh-misc-ban on ficus	Web App Attack
🇮🇹 🐷🐷🐷	2026-08-18 10:31:00 (2 months ago)	Multiple WordPress unauthorized access attempts ...	Brute-Force Bad Web Bot
🇺🇦 URAN Publishing Service	2026-08-18 10:24:55 (2 months ago)	[18/Aug/2026:13:24:55 +0300] -- 34.139.12.221 Ban reason: Scanner [CMS_GENERIC] \| Request: GET //wp- ... show more [18/Aug/2026:13:24:55 +0300] -- 34.139.12.221 Ban reason: Scanner [CMS_GENERIC] \| Request: GET //wp-includes/ID3/license.txt HTTP/1.1 show less	Bad Web Bot Web App Attack
Anonymous	2026-08-18 10:22:04 (2 months ago)	Bot / scanning and/or hacking attempts: POST //xmlrpc.php HTTP/1.1, GET //xmlrpc.php?rsd HTTP/1.1	Hacking Web App Attack
🇦🇺 electronico	2026-08-18 10:21:50 (2 months ago)	34.139.12.221 - - [18/Aug/2026:21:21:49 +1100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 2111 "-" "Mozilla ... show more 34.139.12.221 - - [18/Aug/2026:21:21:49 +1100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 2111 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" ... show less	Brute-Force Web App Attack
🇦🇿 scientra	2026-08-18 10:20:25 (2 months ago)	High-speed endpoint enumeration — //2019/wp-includes/wlwmanifest.xml \| evidence: 9 unrelated unknown ... show more High-speed endpoint enumeration — //2019/wp-includes/wlwmanifest.xml \| evidence: 9 unrelated unknown paths in 20s: //2019/wp-includes/wlwmanifest.xml, //2020/wp-includes/wlwmanifest.xml, //blog/wp-includes/wlwmanifest.xml, //feed/, //web/wp-includes/wlwmanifest.xml [detected by Bitwall WAF] show less	Port Scan Web App Attack
Anonymous	2026-08-18 10:16:23 (2 months ago)	[redacted] 34.139.12.221 - - [18/Aug/2026:12:16:16 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" " ... show more [redacted] 34.139.12.221 - - [18/Aug/2026:12:16:16 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.139.12.221 - - [18/Aug/2026:12:16:17 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.139.12.221 - - [18/Aug/2026:12:16:18 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.139.12.221 - - [18/Aug/2026:12:16:18 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.139.12.221 - - [18/Aug/2026:12:16:19 +0200] "POST //xmlrpc.php HTTP/1.1" 200 416 "-" "Mozilla/5.0 (Windows N ... show less	Hacking Web App Attack
🇮🇹 VHosting	2026-08-18 10:10:05 (2 months ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 10:09:40 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 34.139.12.221 (221.12.139.34.bc.googleuserconte ... show more (mod_security) mod_security (id:225170) triggered by 34.139.12.221 (221.12.139.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 06:09:34.190985 2026] [security2:error] [pid 5078:tid 5078] [client 34.139.12.221:63373] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|edokypros.famagustacyprus.eu\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "edokypros.famagustacyprus.eu"] [uri "/blog/wp-json/wp/v2/users/"] [unique_id "aoQvXopKp1Rpax20AXBePAAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Vano Ganzzz	2026-08-18 10:08:06 (2 months ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 396982 (Google LLC) Prot ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK ASN: 396982 (Google LLC) Protocol: HTTP/1.1 (GET method) Endpoint: //cms/wp-includes/wlwmanifest.xml Timestamp: 2026-08-18T10:08:06Z Ray ID: a2d01d882eb17acc UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 show less	Bad Web Bot
🇩🇪 Hary74656	2026-08-18 10:04:21 (2 months ago)	[Tue Aug 18 12:04:21.263157 2026] [authz_core:error] [pid 59367:tid 59559] [client 34.139.12.221:607 ... show more [Tue Aug 18 12:04:21.263157 2026] [authz_core:error] [pid 59367:tid 59559] [client 34.139.12.221:60768] AH01630: client denied by server configuration: /home/harald/www/aschi.at/xmlrpc.php ... show less	Bad Web Bot
🇫🇷 Lunix	2026-08-18 10:04:01 (2 months ago)		Brute-Force Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 189.164.234.249

🇮🇳 122.177.243.107

🇨🇳 106.59.139.4

🇩🇪 103.47.145.29

🇧🇭 89.148.46.41

🇱🇹 62.60.130.253

🇧🇷 45.231.91.146

🇧🇬 5.188.206.34

🇬🇧 216.226.76.20

🇸🇪 185.246.130.20

🇭🇰 156.225.14.74

🇮🇩 103.165.212.210

🇺🇸 66.132.172.138

🇭🇰 52.128.227.50

🇸🇬 47.84.160.113

🇧🇷 16.5.0.165

🇺🇸 166.239.184.117

🇭🇰 152.32.209.4

🇭🇰 152.32.175.168

🇫🇷 146.70.194.244