JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.28.181.216

34.28.181.216 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	216.181.28.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	Council Bluffs, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.28.181.216

Whois 34.28.181.216

IP Abuse Reports for 34.28.181.216:

This IP address has been reported a total of 28 times from 19 distinct sources. 34.28.181.216 was first reported on August 31st 2026, and the most recent report was 53 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 zynex	2026-09-01 09:36:06 (53 minutes ago)	URL Probing: /.env	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 08:49:32 (1 hour ago)	(mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:49:27.330276 2026] [security2:error] [pid 16995:tid 16995] [client 34.28.181.216:41134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sicktrax.com"] [uri "/.env"] [unique_id "apaRl42AOVDfxkl1mlhn_AAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 08:02:50 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:02:43.303659 2026] [security2:error] [pid 28701:tid 28701] [client 34.28.181.216:57056] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rx-art.com"] [uri "/.env.dev"] [unique_id "apaGo-UcNWl2uBlhdpDvpAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-01 07:49:12 (2 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.28.181.216 (US/United States/216.1 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.28.181.216 (US/United States/216.181.28.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 TPI-Abuse	2026-09-01 07:46:11 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 03:46:06.734778 2026] [security2:error] [pid 20081:tid 20100] [client 34.28.181.216:58678] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gipsonfinancialgroup.digital4z.com"] [uri "/.env.prod"] [unique_id "apaCvlTFwdOKcQJZPCRKMQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-01 07:16:42 (3 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: miner.budyn.wtf \| URI: /actuator/env \| UA: crusader-worker/1.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-01 07:14:02 (3 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇺🇸 kosada.com	2026-09-01 07:07:42 (3 hours ago)	Repeated requests for suspicious nonexistent URLs, for example: /crusader-404-probe (HTTP port 443)	Web App Attack
🇳🇱 e.fierstra	2026-09-01 06:52:07 (3 hours ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 06:40:42 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:40:36.783795 2026] [security2:error] [pid 9056:tid 9056] [client 34.28.181.216:34420] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebeeplace.com"] [uri "/.env.backup"] [unique_id "apZzZE9lwWLf6GB4MhW_TgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-09-01 06:25:54 (4 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 04:52:27 (5 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:52:21.299742 2026] [security2:error] [pid 4120:tid 4120] [client 34.28.181.216:51680] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aaabft.com"] [uri "/.env.prod"] [unique_id "apZaBb3Qt1cQ-7neuiEIsAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 04:28:43 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.28.181.216 (216.181.28.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 00:28:38.709899 2026] [security2:error] [pid 29044:tid 29044] [client 34.28.181.216:44656] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bnaiisraelkearny.royal-barbershop.com"] [uri "/.env.bak"] [unique_id "apZUdsuqs7fDs1YnrrYXqwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 03:05:03 (7 hours ago)	Bot / scanning and/or hacking attempts: GET /crusader-404-probe HTTP/1.1, GET /.env.backup HTTP/1.1, ... show more Bot / scanning and/or hacking attempts: GET /crusader-404-probe HTTP/1.1, GET /.env.backup HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env.example HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env HTTP/1.1, GET /.env.local HTTP/1.1, GET /env HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1, GET /.env.dev HTTP/1.1, GET /actuator/configprops HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.old HTTP/1.1, GET /actuator/env HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.prod HTTP/1.1, GET /wp-config.php.swp HTTP/1.1, GET /_ignition/health-check HTTP/1.1, GET /wp-config.php~ HTTP/1.1 show less	Hacking Web App Attack
🇸🇪 vaia.cloud	2026-09-01 02:55:04 (7 hours ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 203.154.158.195

🇵🇦 190.123.46.136

🇨🇳 119.98.207.134

🇵🇰 103.152.101.206

🇺🇸 65.49.1.94

🇻🇳 27.3.241.155

🇮🇩 202.46.28.140

🇨🇳 182.119.231.168

🇺🇸 173.255.223.32

🇺🇸 173.239.198.139

🇺🇸 135.233.115.202

🇨🇳 121.43.117.28

🇵🇰 103.154.64.176

🇩🇪 88.214.25.121

🇩🇪 69.5.169.21

🇺🇸 47.251.126.207

🇨🇳 36.32.3.57

🇲🇦 196.115.33.249

🇮🇳 122.187.230.38

🇭🇰 42.201.192.17