JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.47.97.16

34.47.97.16 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 78%: ?

78%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	16.97.47.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.47.97.16

Whois 34.47.97.16

IP Abuse Reports for 34.47.97.16:

This IP address has been reported a total of 13 times from 13 distinct sources. 34.47.97.16 was first reported on September 21st 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Hary74656	2026-09-22 05:00:43 (1 day ago)	Fail2Ban on schani.hostmi.at: jail=apache-modsecurity, failures=3. [earlier text truncated] REQUEST- ... show more Fail2Ban on schani.hostmi.at: jail=apache-modsecurity, failures=3. [earlier text truncated] REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [ver "OWASP_CRS/4.29.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "wn-nase.weavernet.at"] [uri "/config/.codex/auth.json"] [unique_id "arILeruMsrWMt6Nx_cSJegAAANg"] [Tue Sep 22 07:00:42.882954 2026] [vhost schani.hostmi.at] [security2:error] [pid 244807:tid 140477097567936] [client 34.47.97.16:49158] [realclient 34.47.97.16:49158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [ver "OWASP_CRS/4.29.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "wn-nase.weavernet.at"] [uri "/api/.codex/auth.json"] [unique_id "arILelgoipYfR-6DzdHwPgAAABc"] show less	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-09-22 02:40:43 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇷 masterguru	2026-09-22 00:06:55 (1 day ago)	Restricted File Access Attempt: AI Coding Assistant Artifact. Matched phrase ".claude/" at REQUEST_F ... show more Restricted File Access Attempt: AI Coding Assistant Artifact. Matched phrase ".claude/" at REQUEST_FILENAME. (930140-193) show less	Hacking
🇩🇪 LRob	2026-09-21 22:42:15 (1 day ago)	This address is looking for secret files on our sites: .git directories, .env files, credential and ... show more This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. \| method: GET \| path: /old/.claude/credentials.json (+16 more) \| 2026-09-21 22:42 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-21 20:03:30 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 34.47.97.16 (16.97.47.34.bc.googleusercontent.c ... show more (mod_security) mod_security (id:210730) triggered by 34.47.97.16 (16.97.47.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 16:03:23.226194 2026] [security2:error] [pid 24130:tid 24130] [client 34.47.97.16:47624] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|boxfactorylofts.com\|F\|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "boxfactorylofts.com"] [uri "/.codex/auth.json.old"] [unique_id "arGNi-MF2NtcxKJHqZU9NgAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-09-21 20:00:43 (1 day ago)	excessive HTTP 404 errors	Bad Web Bot
🇩🇪 et-a_network	2026-09-21 12:28:07 (1 day ago)	34.47.97.16 - - [21/Sep/2026:12:28:05 +0000] "GET /www/.claude/credentials.json HTTP/2.0" 444 0 "-" ... show more 34.47.97.16 - - [21/Sep/2026:12:28:05 +0000] "GET /www/.claude/credentials.json HTTP/2.0" 444 0 "-" "crusader-worker/1.0" host=overleaf.et-a.eu via=172.68.159.197 rt=0.000 34.47.97.16 - - [21/Sep/2026:12:28:05 +0000] "GET /old/.claude/credentials.json HTTP/2.0" 444 0 "-" "crusader-worker/1.0" host=overleaf.et-a.eu via=172.64.198.37 rt=0.000 ... show less	Bad Web Bot Web App Attack
🇳🇴 jad-abuse	2026-09-21 11:33:13 (2 days ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: scanner_u ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: scanner_ua, ai_secrets. Observed by 1 sensor(s); 41 hits. show less	Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-09-21 09:50:18 (2 days ago)	Repeated requests for suspicious nonexistent URLs, for example: /var/www/.codex/auth.json (HTTP/1.1 ... show more Repeated requests for suspicious nonexistent URLs, for example: /var/www/.codex/auth.json (HTTP/1.1 port 443, user agent: "crusader-worker/1.0") show less	Web App Attack
🇫🇷 Lunix	2026-09-21 09:43:35 (2 days ago)		Brute-Force Web App Attack
🇩🇪 rh24	2026-09-21 09:43:33 (2 days ago)	(secretscan) Secret-Scanner (env/git/ssh/credentials) from 34.47.97.16 (KR/South Korea/16.97.47.34.b ... show more (secretscan) Secret-Scanner (env/git/ssh/credentials) from 34.47.97.16 (KR/South Korea/16.97.47.34.bc.googleusercontent.com) show less	Hacking
🇺🇸 dot.mg	2026-09-21 08:18:09 (2 days ago)	Bruteforce	Bad Web Bot
🇬🇧 consul.to	2026-09-21 05:56:56 (2 days ago)	Web attack/malicious scanning detected	Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 216.155.93.75

🇭🇰 156.225.14.74

🇸🇬 47.128.61.199

🇵🇱 176.53.159.197

🇸🇬 157.245.204.205

🇳🇱 93.123.109.178

🇷🇴 92.118.39.209

🇨🇦 85.217.149.53

🇩🇪 31.13.190.50

🇦🇺 194.193.175.82

🇵🇱 94.26.88.12

🇷🇴 92.118.39.14

🇯🇵 82.40.34.92

🇺🇸 45.82.244.8

🇧🇪 35.195.87.78

🇹🇷 23.26.50.80

🇱🇻 213.176.24.46

🇮🇳 210.212.136.3

🇪🇬 197.199.224.52

🇩🇪 146.70.36.70