JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

34.39.252.178

Recent Activity

Abuse confidence score ?

100% Critical

21 reports

20 reporters · latest 3 days ago

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	178.252.39.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 34.39.252.178

This IP address has been reported a total of 21 times from 20 distinct sources. 34.39.252.178 was first reported on September 20th 2026, and the most recent report was 3 days ago. In the last 60 days, the top reporter locations were: Germany with 8 reports; Czechia with 3 reports; France with 2 reports. The most common categories in these recent reports were: Web App Attack 19 times; Brute-Force 8 times; Hacking 7 times; Bad Web Bot 3 times; SQL Injection 2 times; Other 9 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-09-21 00:48:56 (3 days ago)	Repeated exploit attempts, for example: /.env.staging /.env (HTTP/1.1 port 443, user agent: "Mozilla ... show more Repeated exploit attempts, for example: /.env.staging /.env (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36") show less	Web App Attack
🇩🇪 Gwyneth Llewelyn	2026-09-21 00:41:53 (3 days ago)	2026/09/21 01:41:44 [error] 325888#325888: 870673 access forbidden by rule, client: 34.39.252.178, ... show more 2026/09/21 01:41:44 [error] 325888#325888: 870673 access forbidden by rule, client: 34.39.252.178, server: [redacted], request: "GET /.env HTTP/1.1", host: "mta-sts.[redacted]" 34.39.252.178 - - [21/Sep/2026:01:41:44 +0100] "GET /.env HTTP/1.1" 403 1178 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 2026/09/21 01:41:51 [error] 325888#325888: *870673 access forbidden by rule, client: 34.39.252.178, server: [redacted], request: "GET /app/.env HTTP/1.1", host: "mta-sts.[redacted]" show less	Brute-Force Web App Attack
🇩🇪 auridh	2026-09-21 00:38:49 (3 days ago)	Ip 34.39.252.178 performed 'crowdsecurity/appsec-vpatch' (2 events over 444.489148ms) at 2026-09-21 ... show more Ip 34.39.252.178 performed 'crowdsecurity/appsec-vpatch' (2 events over 444.489148ms) at 2026-09-21 00:37:57.474411914 +0000 UTC Ip 34.39.252.178 performed 'crowdsecurity/http-admin-interface-probing' (6 events over 40.014563381s) at 2026-09-21 00:38:46.331151862 +0000 UTC Ip 34.39.252.178 performed 'crowdsecurity/http-probing' (11 events over 2.544131481s) at 2026-09-21 00:37:59.87449588 +0000 UTC Ip 34.39.252.178 performed 'crowdsecurity/http-sensitive-files' (5 events over 1.295598445s) at 2026-09-21 00:37:58.62616264 +0000 UTC Ip 34.39.252.178 performed 'crowdsecurity/http-technology-probing' (1 events over 0s) at 2026-09-21 00:38:44.375332909 +0000 UTC WAF block: crowdsecurity/vpatch-env-access from 34.39.252.178 ([REDACTED]) (522 alerts) WAF block: crowdsecurity/vpatch-git-config from 34.39.252.178 ([REDACTED]) (3 alerts) WAF block: crowdsecurity/vpatch-symfony-profiler from 34.39.252.178 ([REDACTED]) (3 alerts) show less	Web App Attack
🇩🇪 ghostwarriors	2026-09-20 23:50:04 (4 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇵🇱 strefapi_com	2026-09-20 23:44:33 (4 days ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇩🇪 curiosity	2026-09-20 23:39:14 (4 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-admin-interface-probing	Web App Attack Hacking
🇩🇪 yitzhaq	2026-09-20 23:27:54 (4 days ago)	34.39.252.178 - - [21/Sep/2026:01:27:49 +0200] "GET /.env.production HTTP/1.1" 404 519 "-" "Mozilla/ ... show more 34.39.252.178 - - [21/Sep/2026:01:27:49 +0200] "GET /.env.production HTTP/1.1" 404 519 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.39.252.178 - - [21/Sep/2026:01:27:49 +0200] "GET /.env.staging HTTP/1.1" 404 519 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.39.252.178 - - [21/Sep/2026:01:27:50 +0200] "GET /.env.development HTTP/1.1" 404 519 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.39.252.178 - - [21/Sep/2026:01:27:50 +0200] "GET /.env.test HTTP/1.1" 404 519 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.39.252.178 - - [21/Sep/2026:01:27:50 +0200] "GET /.env.remote HTTP/1.1" 404 519 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.39.252.178 - - [21/Sep/2026:01:27: show less	Web App Attack Hacking
🇬🇧 Aetherweb Ark	2026-09-20 23:16:47 (4 days ago)	(mod_security) mod_security (id:949110) triggered by 34.39.252.178 (BR/Brazil/178.252.39.34.bc.googl ... show more (mod_security) mod_security (id:949110) triggered by 34.39.252.178 (BR/Brazil/178.252.39.34.bc.googleusercontent.com): N in the last X secs show less	Web App Attack
🇫🇷 phoenix1jl96	2026-09-20 23:07:08 (4 days ago)	2026/09/21 01:07:07 [error] 901664#901664: 131047 open() "/home/user-data/www/default/mailer/.env" ... show more 2026/09/21 01:07:07 [error] 901664#901664: 131047 open() "/home/user-data/www/default/mailer/.env" failed (2: No such file or directory), client: 34.39.252.178, server: mta-sts.adguardian.ledemon.us, request: "GET /mailer/.env HTTP/1.1", host: "mta-sts.adguardian.ledemon.us" 2026/09/21 01:07:08 [error] 901664#901664: *131047 open() "/usr/local/lib/roundcubemail/.env" failed (2: No such file or directory), client: 34.39.252.178, server: mta-sts.adguardian.ledemon.us, request: "GET /mail/.env HTTP/1.1", host: "mta-sts.adguardian.ledemon.us" ... show less	DNS Compromise DNS Poisoning DDoS Attack Ping of Death Web Spam Email Spam Blog Spam Port Scan Hacking Brute-Force Bad Web Bot SSH Web App Attack
🇨🇭 ca	2026-09-20 22:47:20 (4 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
Anonymous	2026-09-20 22:45:09 (4 days ago)	Scenarios: http-probing, http-sensitive-files Total requests: 56	Web App Attack
🇩🇪 Hazzard	2026-09-20 22:34:30 (4 days ago)	(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)	SQL Injection
Anonymous	2026-09-20 22:05:08 (4 days ago)	WAF repeated trigger detected by Fail2Ban	Web App Attack
🇬🇧 consul.to	2026-09-20 18:55:50 (4 days ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-09-20 17:07:41 (4 days ago)	34.39.252.178 - - [20/Sep/2026:19:07:41 +0200] "GET /.git/config HTTP/1.1" 301 169 "-" "Mozilla/5.0 ... show more 34.39.252.178 - - [20/Sep/2026:19:07:41 +0200] "GET /.git/config HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇪 171.25.158.74

🇨🇳 118.212.121.73

🇺🇸 91.230.168.212

🇺🇸 64.62.197.77

🇯🇵 8.216.5.122

🇹🇼 198.235.24.126

🇦🇷 190.179.180.165

🇨🇱 179.60.77.133

🇨🇱 179.9.158.252

🇧🇷 177.67.5.58

🇨🇳 140.246.108.106

🇨🇳 139.224.136.217

🇺🇸 70.182.26.98

🇳🇱 45.148.10.74

🇬🇧 45.82.76.126

🇺🇸 45.33.12.122

🇺🇸 43.166.129.247

🇺🇦 31.41.66.197

🇨🇳 14.103.118.217

🇳🇱 193.47.62.69