JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.40.28.166

34.40.28.166 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	166.28.40.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.40.28.166

Whois 34.40.28.166

IP Abuse Reports for 34.40.28.166:

This IP address has been reported a total of 23 times from 20 distinct sources. 34.40.28.166 was first reported on September 1st 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-02 22:02:13 (4 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-01. show less	Web App Attack SSH Hacking
🇺🇸 WellSpring	2026-09-02 21:58:11 (4 hours ago)	env leak on odypays.org/server/.env — WellSpr.ing/NetSentinel civic-AI security layer	Web App Attack
Anonymous	2026-09-02 19:18:26 (7 hours ago)	Scanner hitting /.git/config on odoo.osef.cloud (GOOGL-2) — aaguard	Brute-Force Port Scan
Anonymous	2026-09-02 18:36:56 (8 hours ago)	34.40.28.166 - - [02/Sep/2026:18:36:40 +0000] "GET /.git/config HTTP/1.1" 502 552 "-" "Mozilla/5.0 ( ... show more 34.40.28.166 - - [02/Sep/2026:18:36:40 +0000] "GET /.git/config HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" 34.40.28.166 - - [02/Sep/2026:18:36:46 +0000] "GET /.env HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" 34.40.28.166 - - [02/Sep/2026:18:36:49 +0000] "GET /.env.local HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" 34.40.28.166 - - [02/Sep/2026:18:36:52 +0000] "GET /.env.production HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" 34.40.28.166 - - [02/Sep/2026:18:36:55 +0000] "GET /.env.staging HTTP/1.1" 502 552 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, l ... show less	Port Scan Brute-Force
Anonymous	2026-09-02 07:53:15 (18 hours ago)	Banned by Fail2Ban on server	Web App Attack
🇳🇱 Site.eu	2026-09-02 07:46:45 (19 hours ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 TPI-Abuse	2026-09-02 07:22:00 (19 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.40.28.166 (166.28.40.34.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 34.40.28.166 (166.28.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 03:21:53.793594 2026] [security2:error] [pid 25306:tid 25306] [client 34.40.28.166:34104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "omegacares.com.au.tckgbookkeeping.biz"] [uri "/.git/config"] [unique_id "apfOke_T5GCVi-bBcBERrQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-02 05:59:32 (20 hours ago)	Scenarios: http-sensitive-files Total requests: 32	Web App Attack
🇨🇭 Ribeye375	2026-09-02 05:57:37 (20 hours ago)	HIPS web-exfiltration - Block tcp/0:65535	Web App Attack
Anonymous	2026-09-02 04:05:27 (22 hours ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
🇳🇱 debestelapp	2026-09-02 03:35:10 (23 hours ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-09-02 03:22:35 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.40.28.166 (166.28.40.34.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 34.40.28.166 (166.28.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 23:22:27.546285 2026] [security2:error] [pid 1314:tid 1314] [client 34.40.28.166:54702] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "omahareact.org"] [uri "/.git/config"] [unique_id "apeWc4LAHBS_TEy7O45OewAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-02 00:49:05 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇩🇪 gadix	2026-09-02 00:20:10 (1 day ago)	[02/Sep/2026:02:20:09.771910 +0200] apdruXfbhoMAuhiNYlrL6gAAAAY 34.40.28.166 48274 127.0.0.1 7081 [0 ... show more [02/Sep/2026:02:20:09.771910 +0200] apdruXfbhoMAuhiNYlrL6gAAAAY 34.40.28.166 48274 127.0.0.1 7081 [02/Sep/2026:02:20:09.797543 +0200] apdruV_UGP3smBxNlYfzWgAAAAA 34.40.28.166 48286 127.0.0.1 7081 [02/Sep/2026:02:20:09.809646 +0200] apdruZUiwQ7aN6aueaBXvQAAAAU 34.40.28.166 48288 127.0.0.1 7081 ... show less	Web App Attack
🇩🇪 Petros Stefanakis	2026-09-02 00:04:32 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 34.40.28.166 (DE/Germany/166.28.40.34.b ... show more (mod_security) mod_security triggered on hostname [redacted] 34.40.28.166 (DE/Germany/166.28.40.34.bc.googleusercontent.com) show less	SQL Injection

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 190.102.47.62

🇺🇸 170.106.143.6

🇲🇾 124.82.153.7

🇩🇪 216.26.248.254

🇳🇱 204.76.203.213

🇲🇾 202.165.22.102

🇭🇰 199.45.155.58

🇺🇸 198.199.104.179

🇳🇱 192.253.248.223

🇩🇪 185.220.101.35

🇸🇬 182.19.219.131

172.16.227.85

🇺🇸 159.223.167.102

🇵🇰 153.117.13.139

🇹🇼 128.14.236.128

🇨🇳 124.131.111.165

🇺🇦 91.225.4.183

🇷🇺 79.120.30.97

🇰🇷 61.72.130.179

🇫🇷 31.36.173.122