JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.154.207.138

34.154.207.138 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	138.207.154.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇮🇹 Italy
City	Milan, Lombardy

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.154.207.138

Whois 34.154.207.138

IP Abuse Reports for 34.154.207.138:

This IP address has been reported a total of 39 times from 31 distinct sources. 34.154.207.138 was first reported on September 15th 2026, and the most recent report was 39 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 rubixstudios	2026-09-18 07:12:02 (39 minutes ago)	Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360	DDoS Attack Brute-Force Web App Attack
Anonymous	2026-09-18 06:48:26 (1 hour ago)	Scenarios: http-admin-interface-probing, http-probing, http-sensitive-files Total requests: 213	Web App Attack
🇫🇷 Little Iguana	2026-09-18 06:28:26 (1 hour ago)	Attempt to hack Wordpress Login, XMLRPC or other login	Hacking
🇮🇳 evicky2002	2026-09-18 06:00:02 (1 hour ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 4server	2026-09-18 05:51:52 (1 hour ago)	[FriSep1807:51:49.4180152026][security2:error][pid3212833:tid3212875][client34.154.207.138:0]ModSecu ... show more [FriSep1807:51:49.4180152026][security2:error][pid3212833:tid3212875][client34.154.207.138:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\\\\\\\\\$\\|.\\)\\\\\\\\\)\\|\\\\\\\\{.\\\\\\\\\}\)\\|[\<\>]\\\\\\\\$.\\\\\\\\\$\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$$\(41\271$\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require$child_process$.execsync$echo\$\(\(41\271$\)\\|base64-w0\).tostring.trimthrowobject.assign$newerror\(next_redirect${digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"autoconfig.vg13.ch\"][uri\"/\"][unique_id\"aqzRdYrN-U-sHdY_jGDFmQAAAEA\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-09-17 04:58:35 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇩🇪 svr	2026-09-17 03:41:08 (1 day ago)	HC-Flood Web Scanner	Web App Attack
🇺🇦 URAN Publishing Service	2026-09-17 03:31:43 (1 day ago)	[17/Sep/2026:06:31:43 +0300] -- 34.154.207.138 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /.gi ... show more [17/Sep/2026:06:31:43 +0300] -- 34.154.207.138 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /.git/config HTTP/1.1 show less	Bad Web Bot Web App Attack
🇨🇭 Ribeye375	2026-09-17 03:04:56 (1 day ago)	HIPS web-exfiltration - Block tcp/0:65535	Web App Attack
🇦🇺 paulshipley.com.au	2026-09-17 02:43:10 (1 day ago)	[Thu Sep 17 12:43:10.394844 2026] [security2:error] [pid 438186] [client 34.154.207.138:38026] [clie ... show more [Thu Sep 17 12:43:10.394844 2026] [security2:error] [pid 438186] [client 34.154.207.138:38026] [client 34.154.207.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "embodiment.mareeshefford.com"] [uri "/"] [unique_id "aqtTvmDZ3edCN-yQ435P1QAAAAI"] ... show less	Web App Attack
🇵🇱 Budyn	2026-09-16 13:57:26 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: api.goblinpot.online \| URI: /.git/config \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 09:48:40 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 34.154.207.138 (138.207.154.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.154.207.138 (138.207.154.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 05:48:34.120994 2026] [security2:error] [pid 29541:tid 29541] [client 34.154.207.138:38706] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "athletefirst.org"] [uri "/.git/config"] [unique_id "aqpl8uWWV_jhCHJ-9O4TvQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 WellSpring	2026-09-16 09:29:16 (1 day ago)	env leak on athird.org/backend/.env — WellSpr.ing/NetSentinel civic-AI security layer	Web App Attack
🇺🇸 kosada.com	2026-09-16 08:58:42 (1 day ago)	Repeated exploit attempts, for example: /.env.staging /.env (HTTP/1.1 port 443, user agent: "Mozilla ... show more Repeated exploit attempts, for example: /.env.staging /.env (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36") show less	Web App Attack
Anonymous	2026-09-16 08:57:35 (1 day ago)	[ssd5.kdns.gr] httpd-config-scan: sites=www.athensbond.gr; logs=/var/log/httpd/domains/athensbond.gr ... show more [ssd5.kdns.gr] httpd-config-scan: sites=www.athensbond.gr; logs=/var/log/httpd/domains/athensbond.gr.log; samples=/.git/config \| /.env \| /.env.local show less	Hacking Web App Attack

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 213.177.179.113

🇳🇱 195.178.110.218

🇱🇺 185.221.132.179

🇺🇸 162.216.150.29

🇰🇷 125.143.200.198

🇧🇪 34.156.121.46

🇮🇪 2a05:d018:1d9d:e700:d98:a8:a3af:f6ed

🇵🇭 222.127.220.146

🇺🇸 170.250.67.249

🇨🇳 119.249.100.236

🇷🇺 95.37.106.35

🇩🇪 62.241.62.176

🇬🇧 37.10.113.222

🇷🇴 2.57.122.168

🇨🇳 171.11.196.56

🇸🇬 82.109.96.210

🇺🇸 66.132.186.133

🇺🇸 45.74.252.101

🇺🇸 20.118.228.102

🇬🇧 5.226.140.30