JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.40.56.211

34.40.56.211 was found in our database!

This IP was reported 87 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	211.56.40.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.40.56.211

Whois 34.40.56.211

IP Abuse Reports for 34.40.56.211:

This IP address has been reported a total of 87 times from 71 distinct sources. 34.40.56.211 was first reported on October 15th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Starburst SysOp Team	2026-10-17 15:38:47 (1 hour ago)	HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ... show more HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-mnz6-1) show less	Bad Web Bot
🇧🇷 dermatovirtual	2026-10-17 11:55:45 (5 hours ago)	Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ... show more Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 168 unauthorized requests recorded between 2026-10-16 11:52:42 UTC and 2026-10-16 11:52:54 UTC (rate: ~168 req/min). Edge perimeter firewall drop active. Log sample: [2026-10-16 11:52:54 UTC] IP: 34.40.56.211 - W3C IIS (Port 443): GET /static../.env -> HTTP 404 [CLIENT: 34.40.56.211] [2026-10-16 11:52:54 UTC] IP: 34.40.56.211 - W3C IIS (Port 443): GET /images../.env -> HTTP 404 [CLIENT: 34.40.56.211] [2026-10-16 11:52:54 UTC] IP: 34.40.56.211 - W3C IIS (Port 443): GET /img../.env -> HTTP 404 [CLIENT: 34.40.56.211] show less	Bad Web Bot Web App Attack
🇩🇪 updown.io	2026-10-17 11:54:49 (5 hours ago)	{"level":"info","ts":1792238087.5435956,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1792238087.5435956,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.40.56.211","remote_port":"55358","client_ip":"34.40.56.211","proto":"HTTP/2.0","method":"GET","host":"status.srvhst.com","uri":"/asset-manifest.json","headers":{"Sec-Fetch-User":["?1"],"X-Nextjs-Data":["1"],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Ch-Ua-Platform":["\"macOS\""],"Sec-Fetch-Site":["none"],"Upgrade-Insecure-Requests":["1"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Fetch-Dest":["document"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8"],"Sec-Fetch-Mode":["navigate"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Priority":["u=0, i"],"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip, deflate, br, zstd"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:s ... show less	DDoS Attack Web App Attack
🇺🇸 Starburst SysOp Team	2026-10-17 08:45:59 (8 hours ago)	HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ... show more HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-iad5-2) show less	Bad Web Bot
Anonymous	2026-10-17 08:03:28 (9 hours ago)	34.40.56.211 - - [17/Oct/2026:03:02:54 -0500] "GET /.env.supabase HTTP/1.1" 403 199 "-" "Mozilla/5.0 ... show more 34.40.56.211 - - [17/Oct/2026:03:02:54 -0500] "GET /.env.supabase HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)" 172.71.164.231 34.40.56.211 - - [17/Oct/2026:03:02:55 -0500] "GET /.env.staging.local HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" 172.71.164.192 34.40.56.211 - - [17/Oct/2026:03:02:55 -0500] "GET /.env.keys HTTP/1.1" 403 199 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 172.71.164.192 34.40.56.211 - - [17/Oct/2026:03:02:55 -0500] "GET /.env.secret HTTP/1.1" 403 199 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" 172.71.164.230 34.40.56.211 - - [17/Oct/2026:03:02:55 -0500] "GET /.env.credentials HTTP/1.1" 403 199 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" 172.71.164.192 34.40.56.211 - - [17/Oct/2026:03:02:55 -0500] "G ... show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 openstrike.co.uk	2026-10-17 05:16:18 (12 hours ago)	16 attacks on password/key grabbing URLs: GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ss ... show more 16 attacks on password/key grabbing URLs: GET /__vite_rsc_findSourceMapURL?filename=file:///root/.ssh/id_rsa&environmentName=rsc HTTP/1.1 show less	Hacking
🇫🇷 IRISIO	2026-10-16 22:59:31 (18 hours ago)	scans/SQL injection/spam posts : 38526 queries	Web App Attack SQL Injection
🇳🇱 Savvii	2026-10-16 19:54:44 (21 hours ago)	20 attempts against mh-misbehave-ban on lunar	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-10-16 16:45:04 (1 day ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇧🇷 dermatovirtual	2026-10-16 11:54:23 (1 day ago)	Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ... show more Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 168 unauthorized requests recorded between 2026-10-16 11:52:42 UTC and 2026-10-16 11:52:54 UTC (rate: ~168 req/min). Edge perimeter firewall drop active. Log sample: [2026-10-16 11:52:54 UTC] IP: 34.40.56.211 - W3C IIS (Port 443): GET /static../.env -> HTTP 404 [CLIENT: 34.40.56.211] [2026-10-16 11:52:54 UTC] IP: 34.40.56.211 - W3C IIS (Port 443): GET /images../.env -> HTTP 404 [CLIENT: 34.40.56.211] [2026-10-16 11:52:54 UTC] IP: 34.40.56.211 - W3C IIS (Port 443): GET /img../.env -> HTTP 404 [CLIENT: 34.40.56.211] show less	Bad Web Bot Web App Attack
🇳🇱 vintia.cloud	2026-10-16 11:38:11 (1 day ago)	2026-10-16 11:38 UTC HTTPS/443 - exploit and credential scanning. 850 GET/POST requests to 199 disti ... show more 2026-10-16 11:38 UTC HTTPS/443 - exploit and credential scanning. 850 GET/POST requests to 199 distinct paths that do not exist on this application, across 4 hostnames, first seen 2026-10-15 10:21. Sample paths: /.env, /@fs/.env, /.env.local, /.env.production, /.env.development, /@fs/../.env. User-agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplex". Block cycle 2 for this address. show less	Web App Attack Hacking
🇩🇪 pscriptos	2026-10-16 11:20:41 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇮 NoaQT	2026-10-16 10:52:23 (1 day ago)	2026-10-16T10:52:22.711365+00:00 ingress-1 haproxy[275]: 34.40.56.211:57918 [16/Oct/2026:10:52:22.71 ... show more 2026-10-16T10:52:22.711365+00:00 ingress-1 haproxy[275]: 34.40.56.211:57918 [16/Oct/2026:10:52:22.711] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/221/0/0/0 0/0 "GET https://dev.mentis.si/terraform.tfstate HTTP/2.0" 2026-10-16T10:52:22.713236+00:00 ingress-1 haproxy[275]: 34.40.56.211:57918 [16/Oct/2026:10:52:22.712] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/221/0/0/0 0/0 "GET https://dev.mentis.si/docker-compose.yaml HTTP/2.0" 2026-10-16T10:52:22.768371+00:00 ingress-1 haproxy[275]: 34.40.56.211:57918 [16/Oct/2026:10:52:22.768] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/221/0/0/0 0/0 "POST https://dev.mentis.si/api/graphql HTTP/2.0" 2026-10-16T10:52:22.769614+00:00 ingress-1 haproxy[275]: 34.40.56.211:57918 [16/Oct/2026:10:52:22.769] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 229/221/0/0/0 0/0 "GET https://dev.mentis.si/.firebaserc HTTP/2.0" 2026-10-16T10:52:22.777344+00:00 ingress-1 haproxy[275]: 34.40.56.211:57918 [ ... show less	DDoS Attack
🇸🇮 extremevital	2026-10-16 09:30:45 (1 day ago)	34.40.56.211 [16/Oct/2026:11:30:45 +0200] RATELIMIT: "GET /pages/index.astro.mjs.map HTTP/2.0" 401 1 ... show more 34.40.56.211 [16/Oct/2026:11:30:45 +0200] RATELIMIT: "GET /pages/index.astro.mjs.map HTTP/2.0" 401 172 0.000 "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)" ... show less	Bad Web Bot
Anonymous	2026-10-16 09:10:27 (1 day ago)	Web scanner: GET /_image?href=/../../../.env	Web App Attack Hacking

Showing 1 to 15 of 87 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 198.74.56.66

🇻🇳 103.179.191.69

🇫🇷 91.196.152.191

🇲🇾 47.250.38.192

🇹🇷 159.253.36.212

🇨🇳 113.95.241.112

🇸🇮 102.220.161.79

🇫🇷 91.196.152.189

🇫🇷 91.196.152.184

🇦🇪 86.98.146.32

🇺🇸 66.132.195.20

🇺🇸 8.228.76.41

🇺🇸 4.227.177.11

🇧🇷 201.28.176.31

🇺🇸 154.198.14.27

🇫🇷 91.196.152.125

🇫🇷 91.196.152.124

🇫🇷 91.196.152.13

🇳🇱 91.92.40.76

🇬🇧 35.203.210.173