This IP address has been reported a total of
27
times from
25 distinct
sources.
34.156.241.109 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 6
reports;
France
with 5
reports;
United States of America
with 3
reports.
The most common categories in these recent reports were:
Port Scan
16
times;
Brute-Force
9
times;
Email Spam
5
times;
Hacking
2
times;
DDoS Attack
2
times;
Other
6
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 16 11:33:50 localhost postfix/smtpd[2992119]: improper command pipelining after CONNECT from 109 ...
show moreOct 16 11:33:50 localhost postfix/smtpd[2992119]: improper command pipelining after CONNECT from 109.241.156.34.bc.googleusercontent.com[34.156.241.109]: \026\003\001\005\304\001\000\005\300\003\003\222#\210\003\362\217\023~\347&>5\363;@\260/`\314.z\257\273\032`\231\035\335G\2174c \272c\006\242\355\350M\344\260\247\272\306\306)[\305M"\320\000\030\304Y\274J\366J\301\260\330\266\322\0002\300+\300/\300,\3000\314\251\314\250\300\t\300\023\300\n\300\024\000\234
Oct 16 11:33:50 localhost postfix/smtpd[2992120]: improper command pipelining after CONNECT from 109.241.156.34.bc.googleusercontent.com[34.156.241.109]: ;\000\000\000\001\000\000\000\000\000\000\000\324\a\000\000\000\000\000\000admin.$cmd\000\000\000\000\000\377\377\377\377\024\000\000\000\001hello\000\000\000\000\000\000\000\360?\0008\000\000\000\003\000\000\000\000\000\000\000\335\a\000\000\000\000\000\000\000#\000\000\000\001hello\000\000\000\000\000\000\000\360?\002
Oct 16 11:33:50 localhost postfix/smtpd[2992121]: improper comm
...
show less
Automated scan detection against redacted protected targets. Hits=32; port 23 proto 6 detection hone ...
show moreAutomated scan detection against redacted protected targets. Hits=32; port 23 proto 6 detection honeypot_tcp
show less
2026-10-16T09:13:11.366402+02:00 mx1 postfix/smtp/smtpd[2589365]: improper command pipelining after ...
show more2026-10-16T09:13:11.366402+02:00 mx1 postfix/smtp/smtpd[2589365]: improper command pipelining after CONNECT from 109.241.156.34.bc.googleusercontent.com[34.156.241.109]: HELP
2026-10-16T09:13:11.398917+02:00 mx1 postfix/smtp/smtpd[2598849]: improper command pipelining after CONNECT from 109.241.156.34.bc.googleusercontent.com[34.156.241.109]:
2026-10-16T09:13:11.435445+02:00 mx1 postfix/smtp/smtpd[2573195]: improper command pipelining after CONNECT from 109.241.156.34.bc.googleusercontent.com[34.156.241.109]: GET / HTTP/1.0
show less
Telnet honeypot observed an automated Telnet credential spray, and an Nmap-style service-detection s ...
show moreTelnet honeypot observed an automated Telnet credential spray, and an Nmap-style service-detection scan against TCP/23. sessions=9.
show less
Port Scan
Brute-Force
IoT Targeted
Anonymous
Kept connecting and disconnecting without issuing any commands
postfix Server DDoS - AUTH drops, early HANGUPs, other DDoS attacks, etc. Might contain brute-force ...
show morepostfix Server DDoS - AUTH drops, early HANGUPs, other DDoS attacks, etc. Might contain brute-force dictionary attack sightings on IMAP and SMTP.
show less
PortSentry honeypot: unsolicited TCP connection to closed decoy port 23 (Telnet) on a host running n ...
show morePortSentry honeypot: unsolicited TCP connection to closed decoy port 23 (Telnet) on a host running no such service. Automated port-scan detection at 2026-10-16T05:12:35Z.
show less
Unsolicited TCP connection from 34.156.241.109 to port 0 at 2026-10-16T04:13:23Z. Source IP complete ...
show moreUnsolicited TCP connection from 34.156.241.109 to port 0 at 2026-10-16T04:13:23Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring.
show less
2026-10-16T05:56:26.568128+02:00 REDACTED postfix/postscreen[2551163]: PREGREET 18 after 0.01 from [ ...
show more2026-10-16T05:56:26.568128+02:00 REDACTED postfix/postscreen[2551163]: PREGREET 18 after 0.01 from [34.156.241.109]:27564: EHLO example.com\r\n
...
show less