JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.52.158.72

34.52.158.72 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	72.158.52.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇪 Belgium
City	Brussels, Brussels Capital

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.52.158.72

Whois 34.52.158.72

IP Abuse Reports for 34.52.158.72:

This IP address has been reported a total of 24 times from 23 distinct sources. 34.52.158.72 was first reported on June 24th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mnsf	2026-06-25 21:22:18 (1 day ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-06-25 05:14:33 (1 day ago)	13 attacks on PHP URLs, Wordpress URLs: GET //xmlrpc.php?rsd HTTP/1.1 GET //cms/wp-includes/wlwmanif ... show more 13 attacks on PHP URLs, Wordpress URLs: GET //xmlrpc.php?rsd HTTP/1.1 GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1 show less	Web App Attack
🇫🇷 Baking333	2026-06-24 16:19:06 (2 days ago)	[redacted] 34.52.158.72 - - [24/Jun/2026:17:19:04 +0100] "GET //wp-includes/ID3/[redacted] HTTP/1.1" ... show more [redacted] 34.52.158.72 - - [24/Jun/2026:17:19:04 +0100] "GET //wp-includes/ID3/[redacted] HTTP/1.1" 302 6773 0/102031 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.52.158.72 - - [24/Jun/2026:17:19:04 +0100] "GET /[redacted]?rsd HTTP/1.1" 302 1554 0/51772 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" show less	Bad Web Bot Web App Attack
Anonymous	2026-06-24 16:12:13 (2 days ago)	Bot / seems abusive / Apache connections: 25	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-06-24 16:08:48 (2 days ago)	141.444 requests in 1 hour (2mos3w5d)	Brute-Force Bad Web Bot
🇺🇸 aks4226	2026-06-24 16:07:31 (2 days ago)	Bot search, attacking common web applications.	Web App Attack
🇳🇱 Site.eu	2026-06-24 16:04:19 (2 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 Ba-Yu	2026-06-24 15:59:26 (2 days ago)	WP-xmlrpc exploit	Web Spam Blog Spam Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 15:58:52 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 34.52.158.72 (72.158.52.34.bc.googleusercontent ... show more (mod_security) mod_security (id:225170) triggered by 34.52.158.72 (72.158.52.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 11:58:44.098400 2026] [security2:error] [pid 13818:tid 13818] [client 34.52.158.72:52938] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|drbolen.derekvantreese.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "drbolen.derekvantreese.com"] [uri "/wp-includes/id3/license.txt/wp-json/wp/v2/users/"] [unique_id "ajv-tKFX-9AzwmI6Nm4SJgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇿 Tripwire	2026-06-24 15:58:46 (2 days ago)	Scanning for exploits - //wp-includes/ID3/license.txt	Web App Attack
🇩🇪 Skyrider	2026-06-24 15:51:18 (2 days ago)	Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.	Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-06-24 15:47:28 (2 days ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
Anonymous	2026-06-24 15:47:26 (2 days ago)	[redacted] 34.52.158.72 - - [24/Jun/2026:17:47:21 +0200] "POST //xmlrpc.php HTTP/1.1" 200 414 "-" "M ... show more [redacted] 34.52.158.72 - - [24/Jun/2026:17:47:21 +0200] "POST //xmlrpc.php HTTP/1.1" 200 414 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.52.158.72 - - [24/Jun/2026:17:47:21 +0200] "POST //xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.52.158.72 - - [24/Jun/2026:17:47:22 +0200] "POST //xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.52.158.72 - - [24/Jun/2026:17:47:22 +0200] "POST //xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" [redacted] 34.52.158.72 - - [24/Jun/2026:17:47:23 +0200] "POST //xmlrpc.php HTTP/1.1" 200 449 "-" "Mozilla/5.0 (Windows N ... show less	Hacking Web App Attack
🇬🇷 setupgr	2026-06-24 15:44:41 (2 days ago)	(mod_security) mod_security (id:11000011) triggered by 34.52.158.72 (BE/Belgium/Brussels Capital/Bru ... show more (mod_security) mod_security (id:11000011) triggered by 34.52.158.72 (BE/Belgium/Brussels Capital/Brussels/-/[AS396982 GOOGLE-CLOUD-PLATFORM]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Jun 24 18:44:37.785262 2026] [security2:error] [pid 131143:tid 131319] [client 34.52.158.72:63037] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "131"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 72.158.52.34.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "doityourself.gr"] [uri "/"] [unique_id "ajv7ZeEq_-SxrJhMvn9RtAAAAYU"] show less	Port Scan
🇩🇪 on-com	2026-06-24 15:38:32 (2 days ago)	URL scan	Brute-Force Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.254

🇷🇸 185.71.88.91

🇨🇴 143.105.99.197

🇯🇵 8.221.141.177

🇪🇸 193.56.167.59

🇳🇱 176.65.139.217

🇧🇷 160.238.26.174

🇹🇷 159.146.75.247

🇺🇸 107.150.103.155

🇺🇸 73.248.14.105

🇫🇷 51.178.114.78

🇧🇷 43.164.195.160

🇯🇵 8.216.67.195

🇨🇦 208.96.233.67

🇪🇸 188.26.195.9

🇳🇱 176.65.148.97

🇳🇱 176.65.139.249

🇺🇸 162.241.190.226

🇺🇸 159.223.141.184

🇨🇳 117.159.93.197