JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.180.25.197

34.180.25.197 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 75%: ?

75%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	197.25.180.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.180.25.197

Whois 34.180.25.197

IP Abuse Reports for 34.180.25.197:

This IP address has been reported a total of 26 times from 16 distinct sources. 34.180.25.197 was first reported on September 1st 2026, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇱🇻 garmtech.com	2026-09-18 04:45:09 (21 hours ago)	Attempted access to sensitive endpoint (/.vscode/mcp.json) detected. Automated scan or unauthorized ... show more Attempted access to sensitive endpoint (/.vscode/mcp.json) detected. Automated scan or unauthorized probing. show less	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-16 01:19:11 (3 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-09-13 18:10:40 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 34.180.25.197 (197.25.180.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.180.25.197 (197.25.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 14:10:36.052794 2026] [security2:error] [pid 8931:tid 8936] [client 34.180.25.197:59020] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.vnbcares.com"] [uri "/.htaccess"] [unique_id "aqbnHKcUwpTvvhwmx8B6dwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-13 08:02:09 (5 days ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 34.180.25.197 (IN/India/197.25.180.34.bc.googl ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 34.180.25.197 (IN/India/197.25.180.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-196) show less	Hacking
🇳🇱 WeCloudit-Anti-Abuse	2026-09-13 01:02:59 (6 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-09-12 23:19:24 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 34.180.25.197 (197.25.180.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.180.25.197 (197.25.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 19:19:20.435672 2026] [security2:error] [pid 17960:tid 17960] [client 34.180.25.197:58728] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.kcmastercleaners.com"] [uri "/.htaccess"] [unique_id "aqXd-F3HzA0rUjf93N-31AAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-11 12:33:01 (1 week ago)	34.180.25.197 - - \[06/Sep/2026:04:27:02 +0200\] "GET /dump.sql HTTP/1.1" 404 7982 "-" "Mozilla/5.0 ... show more 34.180.25.197 - - \[06/Sep/2026:04:27:02 +0200\] "GET /dump.sql HTTP/1.1" 404 7982 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/124.0 Safari/537.36" 34.180.25.197 - - \[06/Sep/2026:04:27:02 +0200\] "GET /database.sql HTTP/1.1" 404 7982 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/124.0 Safari/537.36" 34.180.25.197 - - \[06/Sep/2026:04:27:02 +0200\] "GET /db.sql HTTP/1.1" 404 2065 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/124.0 Safari/537.36" 34.180.25.197 - - \[06/Sep/2026:04:27:02 +0200\] "GET /backup.sql HTTP/1.1" 404 2065 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/124.0 Safari/537.36" 34.180.25.197 - - \[06/Sep/2026:04:27:02 +0200\] "GET /admin/phpinfo.php HTTP/1.1" 404 2065 "-" "Mozilla/5.0 \(X1 ... show less	Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-09-09 18:12:26 (1 week ago)	(CT) IP 34.180.25.197 (IN/India/197.25.180.34.bc.googleusercontent.com) found to have 620 connection ... show more (CT) IP 34.180.25.197 (IN/India/197.25.180.34.bc.googleusercontent.com) found to have 620 connections show less	DDoS Attack
🇳🇱 BlueWire Hosting	2026-09-09 14:37:33 (1 week ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇫🇷 masterguru	2026-09-09 08:42:10 (1 week ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 34.180.25.197 (IN/India/197.25.180.34.bc.googl ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 34.180.25.197 (IN/India/197.25.180.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-196) show less	Hacking
🇫🇷 dynamix	2026-09-08 19:32:39 (1 week ago)	Multiple WAF Violations	Web App Attack
🇳🇱 Cloud86 B.V.	2026-09-06 05:48:01 (1 week ago)	categories: DDoS Attack	DDoS Attack
🇳🇱 ipoac.nl	2026-09-06 00:44:07 (1 week ago)	-:443 34.180.25.197 - - [06/Sep/2026:02:44:05 +0200] - "GET /.python_history HTTP/1.1" 404 6381 "-" ... show more -:443 34.180.25.197 - - [06/Sep/2026:02:44:05 +0200] - "GET /.python_history HTTP/1.1" 404 6381 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-05 22:21:56 (1 week ago)	(mod_security) mod_security (id:243320) triggered by 34.180.25.197 (197.25.180.34.bc.googleuserconte ... show more (mod_security) mod_security (id:243320) triggered by 34.180.25.197 (197.25.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 18:21:51.915912 2026] [security2:error] [pid 25550:tid 25550] [client 34.180.25.197:58200] ModSecurity: Access denied with code 403 (phase 2). String match "/.profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6621"] [id "243320"] [rev "1"] [msg "COMODO WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)\|\|crochetfreepatterns.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "crochetfreepatterns.com"] [uri "/.profile"] [unique_id "apyV_2lRVqRKAyZ0w4bwPgAAAJQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-05 21:14:19 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 34.180.25.197 (197.25.180.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.180.25.197 (197.25.180.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 17:14:12.469687 2026] [security2:error] [pid 21600:tid 21600] [client 34.180.25.197:44892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.weirdlovemakers.com"] [uri "/.htaccess"] [unique_id "apyGJBghW8JTISATmrMN-wAAADM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.64

🇬🇧 193.32.209.237

🇺🇿 144.124.199.185

🇳🇱 81.19.216.93

🇩🇪 69.5.169.155

🇳🇱 45.148.10.151

🇫🇷 185.177.72.38

🇨🇳 183.219.6.92

🇩🇪 128.14.225.253

🇧🇬 109.160.32.64

🇺🇸 103.143.10.140

🇺🇦 91.211.133.199

🇳🇱 86.92.53.191

🇺🇸 66.132.186.219

🇹🇼 60.199.224.55

🇺🇸 47.77.211.73

🇧🇷 45.237.195.171

🇺🇿 45.9.231.123

🇬🇧 35.203.211.42

🇺🇸 18.116.101.220