JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.159.140.133

34.159.140.133 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	133.140.159.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.159.140.133

Whois 34.159.140.133

IP Abuse Reports for 34.159.140.133:

This IP address has been reported a total of 27 times from 20 distinct sources. 34.159.140.133 was first reported on June 9th 2026, and the most recent report was 29 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-06-10 16:15:54 (29 minutes ago)	BAD BOT - Detected and Blocked.. Matched phrase "YaBrowser" at REQUEST_HEADERS:User-Agent. (1100000- ... show more BAD BOT - Detected and Blocked.. Matched phrase "YaBrowser" at REQUEST_HEADERS:User-Agent. (1100000-196) show less	Bad Web Bot
🇩🇪 4server	2026-06-10 12:54:06 (3 hours ago)	[WedJun1014:54:04.4586032026][security2:error][pid365361:tid365424][client34.159.140.133:0]ModSecuri ... show more [WedJun1014:54:04.4586032026][security2:error][pid365361:tid365424][client34.159.140.133:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpcontacts.bicycleambulance.ch\"][uri\"/backup.sql\"][unique_id\"ailebJ1nZjQWP6RUZfyI4wAAAFg\"] show less	Port Scan Brute-Force Web App Attack
🇮🇹 Inartis	2026-06-10 11:34:10 (5 hours ago)	34.159.140.133 - - [10/Jun/2026:13:34:09 +0200] "GET /server/actuator/heapdump HTTP/1.1" 200 54689 " ... show more 34.159.140.133 - - [10/Jun/2026:13:34:09 +0200] "GET /server/actuator/heapdump HTTP/1.1" 200 54689 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.166 Safari/537.36 OPR/20.0.1396.73172" ... show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-06-10 10:50:10 (5 hours ago)	Try to access /.aws/config	Web App Attack
🇬🇧 consul.to	2026-06-10 10:17:52 (6 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-06-10 08:10:38 (8 hours ago)	(mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 04:10:33.408558 2026] [security2:error] [pid 31051:tid 31051] [client 34.159.140.133:46818] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|primelb.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "primelb.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aikb-UuYjHW0y4GynQDPTQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-10 05:20:28 (11 hours ago)	(mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 01:20:20.898619 2026] [security2:error] [pid 28525:tid 28525] [client 34.159.140.133:45624] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.kraftrealestate.kraftrentals.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kraftrealestate.kraftrentals.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aij0FM6HPudFtubUO56RJwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 updown.io	2026-06-10 05:14:24 (11 hours ago)	{"level":"info","ts":1781068463.6485214,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1781068463.6485214,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.140.133","remote_port":"58660","client_ip":"34.159.140.133","proto":"HTTP/1.1","method":"GET","host":"status.petersfieldmensshed.org.uk","uri":"/_profiler","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.120 Safari/535.2"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.petersfieldmensshed.org.uk","ech":false}},"bytes_read":0,"user_id":"","duration":0.001313298,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}} {"level":"info","ts":1781068463.6521149,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.140.133","remote_port":"58646","client_ip":"34.159.140.133","proto":"HTTP/1.1","meth ... show less	DDoS Attack Web App Attack
🇳🇱 Cloud86 B.V.	2026-06-10 04:39:05 (12 hours ago)	categories: DDoS Attack	DDoS Attack
🇧🇪 cmbplf	2026-06-10 01:51:00 (14 hours ago)	111 requests with url.path *compose.yml	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-09 21:46:29 (18 hours ago)	(mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 17:46:22.945920 2026] [security2:error] [pid 14408:tid 14430] [client 34.159.140.133:56936] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|ywt.bestofthis.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ywt.bestofthis.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aiiJrhJ4xEsU_1IIhxCquAAAAJU"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Aetherweb Ark	2026-06-09 20:08:55 (20 hours ago)	(mod_security) mod_security (id:949110) triggered by 34.159.140.133 (DE/Germany/133.140.159.34.bc.go ... show more (mod_security) mod_security (id:949110) triggered by 34.159.140.133 (DE/Germany/133.140.159.34.bc.googleusercontent.com): N in the last X secs show less	Web App Attack
Anonymous	2026-06-09 18:32:53 (22 hours ago)	(caddyscan) Scanner path probe from 34.159.140.133 (DE/Germany/133.140.159.34.bc.googleusercontent.c ... show more (caddyscan) Scanner path probe from 34.159.140.133 (DE/Germany/133.140.159.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.159.140.133 - - [09/Jun/2026:18:32:49 +0000] "GET /v2/actuator/configprops HTTP/1.1" [REDACTED] 200 2627 34.159.140.133 - - [09/Jun/2026:18:32:49 +0000] "GET /v2/actuator/env HTTP/1.1" [REDACTED] 200 2627 34.159.140.133 - - [09/Jun/2026:18:32:49 +0000] "GET /backend/actuator/heapdump HTTP/1.1" [REDACTED] 200 2627 34.159.140.133 - - [09/Jun/2026:18:32:49 +0000] "GET /actuator/httptrace HTTP/1.1" [REDACTED] 200 2627 34.159.140.133 - - [09/Jun/2026:18:32:49 +0000] "GET /actuator/sessions HTTP/1.1" show less	Port Scan
🇫🇷 dynamix	2026-06-09 17:47:41 (22 hours ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-06-09 15:49:10 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 34.159.140.133 (133.140.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 11:49:06.661517 2026] [security2:error] [pid 28622:tid 28622] [client 34.159.140.133:56282] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|sargous.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sargous.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aig18qFFzg3PVWn8UMfm0QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇸 2a01:71c1:4:d0a5::ffff

🇺🇸 172.217.107.150

🇲🇦 154.144.225.226

🇳🇴 51.120.68.234

🇹🇼 114.35.183.71

🇺🇸 103.143.231.2

🇳🇱 64.89.162.149

🇳🇱 45.148.10.157

🇺🇸 34.63.162.135

🇰🇭 202.79.29.108

🇮🇳 103.109.139.77

🇫🇷 81.249.149.176

🇲🇾 43.252.215.241

🇿🇦 41.193.224.154

🇧🇷 191.36.152.28

🇮🇩 163.227.52.50

🇫🇷 162.19.59.210

🇺🇸 147.185.132.91

🇸🇬 101.47.27.73

🇷🇺 80.69.186.68