JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

34.159.221.108

Recent Activity

Abuse confidence score ?

100% Critical

60 reports

44 reporters · latest 1 day ago

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	108.221.159.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 34.159.221.108

Export CSV

This IP address has been reported a total of 60 times from 44 distinct sources. 34.159.221.108 was first reported on October 8th 2026, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: United States of America with 13 reports; Germany with 10 reports; Netherlands with 8 reports. The most common categories in these recent reports were: Web App Attack 49 times; Brute-Force 29 times; Bad Web Bot 25 times; Port Scan 6 times; Hacking 6 times; Other 5 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 Saec	2026-10-09 05:44:47 (1 day ago)	Honeypot caught: /.env via app2.saec.me. UA: Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://m ... show more Honeypot caught: /.env via app2.saec.me. UA: Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/). show less	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
🇬🇧 openstrike.co.uk	2026-10-09 05:15:01 (1 day ago)	147 attacks on env grabbing URLs (type 2), password/key grabbing URLs, shell probes, env grabbing UR ... show more 147 attacks on env grabbing URLs (type 2), password/key grabbing URLs, shell probes, env grabbing URLs, directory traversals, PHP URLs, VC URLs, config grabbing URLs (type 2): GET /userfiles?path=../../../../proc/self/environ HTTP/1.1 GET /.git-credentials HTTP/1.1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1 GET //.env HTTP/1.1 GET /..%2f..%2f.env HTTP/1.1 POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/1.1 GET /.git/HEAD HTTP/1.1 GET /secrets.json HTTP/1.1 show less	Hacking Web App Attack
🇧🇪 Saec	2026-10-09 03:54:53 (1 day ago)	Honeypot caught: //.env via api.saec.me. UA: Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www. ... show more Honeypot caught: //.env via api.saec.me. UA: Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/). show less	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
🇧🇪 Saec	2026-10-09 02:46:47 (1 day ago)	Honeypot caught: /.env.production via admin.saec.me. UA: Mozilla/5.0 (compatible; xAI-Grok/1.0; +htt ... show more Honeypot caught: /.env.production via admin.saec.me. UA: Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/). show less	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
Anonymous	2026-10-09 02:07:02 (1 day ago)	Automated web scanner. Requested suspicious paths: /dist/manifest.json. UTC: 2026-10-09 01:36:00.	Web App Attack
🇩🇪 Holger	2026-10-09 01:58:49 (1 day ago)	URL probing: GET /userfiles/x?path=../../.env	Web App Attack
🇧🇪 Saec	2026-10-09 01:18:48 (1 day ago)	Jarvis auto-ban: Honeypot /.git/HEAD via saec.me [DE] ASN:Google LLC	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 00:56:48 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:56:42.090007 2026] [security2:error] [pid 14937:tid 14969] [client 34.159.221.108:36842] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|rthomasjr.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rthomasjr.com"] [uri "/z9x8c7v6b5-debug-trigger-rthomasjr.com"] [unique_id "asg7ygHluDcpKg6YNSoqMAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 ciccio diddo	2026-10-08 23:56:05 (1 day ago)	High Burst multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 23:22:46 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:22:41.431183 2026] [security2:error] [pid 10423:tid 10423] [client 34.159.221.108:46474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "royal-barbershop.com"] [uri "/.env.example"] [unique_id "asglwXvhOQntoMya1qNgxwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 on-com	2026-10-08 23:22:32 (1 day ago)	URL scan	Brute-Force Web App Attack
🇩🇪 palzer.IT	2026-10-08 23:08:51 (1 day ago)	Fail2ban automatic report for plesk-apache-badbot: 34.159.221.108 - - [09/Oct/2026:01:08:18 +0200] G ... show more Fail2ban automatic report for plesk-apache-badbot: 34.159.221.108 - - [09/Oct/2026:01:08:18 +0200] GET /lrccgmxvppwxdyrbcpvh [DOMAIN_REMOVED] 404 6438 [DOMAIN_REMOVED] Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@[DOMAIN_REMOVED]) show less	Bad Web Bot
Anonymous	2026-10-08 23:03:39 (1 day ago)	Fail2Ban apache-noscript	Bad Web Bot
🇪🇸 arturotrenard	2026-10-08 22:43:41 (1 day ago)	WordPress attack blocked (wp-defender): exploit-probe: https://rotulosag.com/_image?href=%2F..%2F..% ... show more WordPress attack blocked (wp-defender): exploit-probe: https://rotulosag.com/_image?href=%2F..%2F..%2F..%2F.env show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-08 22:31:03 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercon ... show more (mod_security) mod_security (id:210730) triggered by 34.159.221.108 (108.221.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 18:30:59.915393 2026] [security2:error] [pid 12335:tid 12335] [client 34.159.221.108:35726] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|rotarymagnetics.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rotarymagnetics.com"] [uri "/z9x8c7v6b5-debug-trigger-rotarymagnetics.com"] [unique_id "asgZo0su-PTYKFZzTRESlAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 60 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 165.154.14.170

🇬🇧 77.67.26.60

🇺🇸 4.148.17.94

🇰🇷 183.78.201.108

🇺🇸 172.169.235.142

🇳🇱 94.154.43.164

🇨🇦 85.217.149.73

🇨🇦 85.217.149.63

🇱🇹 62.60.130.253

🇵🇰 154.198.81.163

🇨🇳 125.69.76.148

🇮🇶 65.20.202.4

🇯🇵 43.165.167.72

🇷🇺 5.206.13.207

🇨🇭 209.99.190.110

🇧🇪 198.235.24.212

🇬🇧 193.163.125.90

🇿🇦 165.16.171.117

🇺🇸 159.223.97.218

🇺🇸 143.198.176.202