JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.47.138.180

34.47.138.180 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 84%: ?

84%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	180.138.47.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.47.138.180

Whois 34.47.138.180

IP Abuse Reports for 34.47.138.180:

This IP address has been reported a total of 15 times from 14 distinct sources. 34.47.138.180 was first reported on June 12th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-06-14 05:13:53 (2 days ago)	210 attacks on password grabbing URLs, config grabbing URLs, PHP URLs, deployment descriptor URLs, c ... show more 210 attacks on password grabbing URLs, config grabbing URLs, PHP URLs, deployment descriptor URLs, config grabbing URLs (type 2), site downloads, too many concurrent requests: GET /.vscode/sftp.json HTTP/1.1 GET /.htaccess HTTP/1.1 GET /system/application/config/database.php HTTP/1.1 GET /WEB-INF/web.xml HTTP/1.1 GET /app/config/parameters.yaml HTTP/1.1 GET /dump.zip HTTP/1.1 GET /logs/application.log HTTP/1.1 show less	Hacking Web App Attack Bad Web Bot
🇩🇪 SCHAPPY	2026-06-13 15:58:07 (2 days ago)	Mutliple attempts to access forbidden web resources, HTTP code 403.	Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 15:29:43 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 34.47.138.180 (180.138.47.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210730) triggered by 34.47.138.180 (180.138.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 11:29:37.285807 2026] [security2:error] [pid 31595:tid 31595] [client 34.47.138.180:47362] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.book-runningonempty.coolingsprings.org\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.book-runningonempty.coolingsprings.org"] [uri "/.config/gcloud/credentials.db"] [unique_id "ai13YYlnxdd4zUtpyXDdCgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-13 14:43:56 (2 days ago)	Multiple WAF Violations	Web App Attack
🇳🇱 ConsulHosting	2026-06-13 14:06:14 (2 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇬🇧 cybersteve99	2026-06-13 12:57:29 (2 days ago)	Too many 4xx Requests -	Brute-Force Web App Attack
🇨🇦 polycoda	2026-06-13 08:12:41 (3 days ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based ... show more AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based) - ❌ Excessive 40X Errors (Decay-Based) show less	Hacking Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-06-13 08:07:11 (3 days ago)	Abuse Detected (14)	Brute-Force Web App Attack
🇫🇷 Octopuce	2026-06-13 06:51:54 (3 days ago)	Aggressive web search of vulnerable pages: /secrets/credentials.json /secrets/azure.json /docker-com ... show more Aggressive web search of vulnerable pages: /secrets/credentials.json /secrets/azure.json /docker-compose.staging.yml /docker-compose.dev.yml /d ... show less	Web App Attack
🇩🇪 updown.io	2026-06-13 06:20:37 (3 days ago)	{"level":"info","ts":1781331635.7584093,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1781331635.7584093,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.47.138.180","remote_port":"53674","client_ip":"34.47.138.180","proto":"HTTP/1.1","method":"GET","host":"wvutupdate.lkjihgfedgjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/threaddump","headers":{"User-Agent":["Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G950F Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]}},"bytes_read":0,"user_id":"","duration":0.000199862,"size":0,"status":308,"resp_headers":{"Location":["https://wvutupdate.lkjihgfedgjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/threaddump"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}} {"level":"info","ts":1781331635.759502,"logger":"http.log.access.log1","msg":"handled request","request":{"remot ... show less	DDoS Attack Web App Attack
🇮🇹 VHosting	2026-06-13 05:20:03 (3 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 04:50:40 (3 days ago)	(mod_security) mod_security (id:210730) triggered by 34.47.138.180 (180.138.47.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210730) triggered by 34.47.138.180 (180.138.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 00:50:34.536855 2026] [security2:error] [pid 12906:tid 12906] [client 34.47.138.180:53142] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.salkindsectzerproductions.starrmail.net\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.salkindsectzerproductions.starrmail.net"] [uri "/.config/gcloud/credentials.db"] [unique_id "aizhmjFc_OvQeSe-6QaF4QAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-13 04:36:50 (3 days ago)	(caddyscan) Scanner path probe from 34.47.138.180 (IN/India/180.138.47.34.bc.googleusercontent.com): ... show more (caddyscan) Scanner path probe from 34.47.138.180 (IN/India/180.138.47.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.47.138.180 - - [13/Jun/2026:04:36:46 +0000] "GET /internal/actuator/env HTTP/1.1" [REDACTED] 200 2627 34.47.138.180 - - [13/Jun/2026:04:36:46 +0000] "GET /server/actuator/env HTTP/1.1" [REDACTED] 200 2627 34.47.138.180 - - [13/Jun/2026:04:36:46 +0000] "GET /server/actuator/heapdump HTTP/1.1" [REDACTED] 200 2627 34.47.138.180 - - [13/Jun/2026:04:36:46 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 34.47.138.180 - - [13/Jun/2026:04:36:46 +0000] "GET /internal/actuator/heapdump HTTP/1.1" show less	Port Scan
🇳🇱 Cloud86 B.V.	2026-06-13 03:13:10 (3 days ago)	categories: DDoS Attack	DDoS Attack
🇦🇺 afleventoffice.com.au	2026-06-12 20:22:23 (3 days ago)	GET /app/heapdump HTTP/1.1	Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2001:4830:c200:2:9999::146

🇩🇪 213.209.159.236

🇩🇪 213.209.159.11

🇺🇸 206.0.65.70

🇺🇸 147.185.132.19

🇳🇱 138.226.239.12

🇩🇪 69.5.169.31

🇩🇪 64.188.83.244

🇺🇸 57.151.125.212

🇨🇳 42.51.41.252

🇮🇳 103.108.45.61

🇨🇳 101.96.220.237

🇺🇸 66.132.195.15

🇺🇸 64.62.156.216

🇦🇺 52.123.160.154

🇰🇷 43.155.214.159

🇬🇧 217.146.80.116

🇺🇸 195.184.76.171

🇺🇸 172.110.223.179

🇧🇷 143.95.213.196