JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.158.103.191

34.158.103.191 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 56%: ?

56%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	191.103.158.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇳🇱 Netherlands
City	Groningen, Groningen

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.158.103.191

Whois 34.158.103.191

IP Abuse Reports for 34.158.103.191:

This IP address has been reported a total of 16 times from 9 distinct sources. 34.158.103.191 was first reported on September 15th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-17 22:04:25 (2 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-16. show less	Web App Attack SSH Hacking
🇩🇪 updown.io	2026-09-16 04:40:23 (4 days ago)	{"level":"info","ts":1789533621.1961434,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1789533621.1961434,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.158.103.191","remote_port":"36230","client_ip":"34.158.103.191","proto":"HTTP/1.1","method":"GET","host":"updown.arnext.net","uri":"/.env.development","headers":{"Connection":["keep-alive"],"Next-Action":["x"],"X-Nextjs-Request-Id":["f92dddfa"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["/"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"updown.arnext.net","ech":false}},"bytes_read":0,"user_id":"","duration":0.000155667,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}} {"level":"info","ts":1789533621.2073004,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.158.103.191","remote_port":"36230" ... show less	DDoS Attack Web App Attack
Anonymous	2026-09-15 22:30:06 (4 days ago)	suspicious request in access.log	Web App Attack
🇪🇸 robotstxt	2026-09-15 20:10:59 (5 days ago)	34.158.103.191 - - [15/Sep/2026:20:10:41 +0000] "GET /.env HTTP/1.1" 403 15958 "-" "Mozilla/5.0 (X11 ... show more 34.158.103.191 - - [15/Sep/2026:20:10:41 +0000] "GET /.env HTTP/1.1" 403 15958 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.158.103.191" 34.158.103.191 - - [15/Sep/2026:20:10:41 +0000] "GET /.env.local HTTP/1.1" 403 15958 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.158.103.191" 34.158.103.191 - - [15/Sep/2026:20:10:42 +0000] "GET /.env.production HTTP/1.1" 403 15958 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.158.103.191" 34.158.103.191 - - [15/Sep/2026:20:10:42 +0000] "GET /.env.staging HTTP/1.1" 403 15958 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.158.103.191" 34.158.103.191 - - [15/Sep/2026:20:10:42 +0000] "GET /.env.development HTTP/1.1" 403 15958 "-" "Mozilla/5.0 (X11; Linux x86 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 20:01:30 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 16:01:23.301063 2026] [security2:error] [pid 1931:tid 1931] [client 34.158.103.191:52888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.robotrodeo.chatsupply.us"] [uri "/.git/config"] [unique_id "aqmkE9h7eLEZXBZSD1TgtgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 17:45:21 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 13:45:13.867051 2026] [security2:error] [pid 10186:tid 10186] [client 34.158.103.191:51854] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thewillsmith.com"] [uri "/.git/config"] [unique_id "aqmEKXfMnorKlE20_o9OtQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 zynex	2026-09-15 17:14:50 (5 days ago)	URL Probing: /backend/.env	Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 16:16:53 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 12:16:47.533795 2026] [security2:error] [pid 26332:tid 26332] [client 34.158.103.191:42210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thewhispertwins.com"] [uri "/.git/config"] [unique_id "aqlvb95NtPqtl-2sJJGqQAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 08:07:11 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 04:07:03.469612 2026] [security2:error] [pid 2022:tid 2022] [client 34.158.103.191:57754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerproperties.com"] [uri "/.git/config"] [unique_id "aqj8pyw5YG_BLMXY9TlMMgAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 07:02:28 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 03:02:23.417557 2026] [security2:error] [pid 518132:tid 518132] [client 34.158.103.191:40306] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerloft.com"] [uri "/.git/config"] [unique_id "aqjtf7Y4OspoGBczh2tXWgAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-09-15 06:38:57 (5 days ago)	Multiple WAF Violations	Web App Attack
🇬🇧 consul.to	2026-09-15 06:29:13 (5 days ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 06:06:43 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 02:06:33.124387 2026] [security2:error] [pid 4144:tid 4144] [client 34.158.103.191:35360] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerheath.com"] [uri "/.git/config"] [unique_id "aqjgaWtbEmbTKMK6H75EKwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 05:51:35 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.158.103.191 (191.103.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 01:51:31.510105 2026] [security2:error] [pid 28023:tid 28023] [client 34.158.103.191:52850] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerg.com"] [uri "/.git/config"] [unique_id "aqjc4-E53m75Pf2KRM3LCwAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BlueWire Hosting	2026-09-15 05:42:50 (5 days ago)	High-confidence malicious configuration/VCS probe	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 193.46.255.86

🇩🇪 43.131.36.84

🇺🇸 185.191.171.11

🇺🇸 70.167.233.150

🇺🇸 52.167.144.166

🇸🇬 47.82.6.90

🇺🇸 34.23.50.249

🇶🇦 34.18.145.16

🇷🇺 31.8.174.199

🇬🇧 5.226.140.12

🇧🇪 198.235.24.252

🇺🇸 185.198.240.199

🇳🇱 109.160.32.30

🇳🇱 94.154.43.254

🇸🇪 78.66.44.246

🇺🇸 47.157.213.192

🇰🇷 220.80.228.74

🇰🇷 210.99.94.2

🇦🇷 190.220.172.154

🇲🇦 105.157.149.119