JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.65.2.153

34.65.2.153 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 74%: ?

74%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	153.2.65.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.65.2.153

Whois 34.65.2.153

IP Abuse Reports for 34.65.2.153:

This IP address has been reported a total of 13 times from 12 distinct sources. 34.65.2.153 was first reported on September 21st 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-09-22 03:15:56 (1 day ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.65.2.153 (CH/Switzerland/153.2.65. ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 34.65.2.153 (CH/Switzerland/153.2.65.34.bc.googleusercontent.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇩🇪 ghostwarriors	2026-09-22 02:50:06 (1 day ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-09-22 02:28:32 (1 day ago)	34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 575 "-" "crusa ... show more 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 575 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /data/.claude.json HTTP/1.1" 404 575 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /html/.codex/auth.json HTTP/1.1" 404 4533 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /srv/.codex/auth.json HTTP/1.1" 404 575 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /www/.claude/credentials.json HTTP/1.1" 404 4532 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /home/.codex/auth.json HTTP/1.1" 404 575 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /wwwroot/.codex/auth.json HTTP/1.1" 404 575 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /uploads/.codex/auth.json HTTP/1.1" 404 575 "-" "crusader-worker/1.0" 34.65.2.153 - - [22/Sep/2026:04:28:28 +0200] "GET /.cod show less	Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-09-22 00:44:39 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-09-22 00:31:57 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 34.65.2.153 (153.2.65.34.bc.googleusercontent.c ... show more (mod_security) mod_security (id:210730) triggered by 34.65.2.153 (153.2.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:31:53.529102 2026] [security2:error] [pid 19708:tid 19708] [client 34.65.2.153:45016] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|littlestarbookspub.com\|F\|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "littlestarbookspub.com"] [uri "/.codex/auth.json.bak"] [unique_id "arHMeTHryyY0exYwk0THMQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-22 00:13:11 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 34.65.2.153 (153.2.65.34.bc.googleusercontent.c ... show more (mod_security) mod_security (id:210730) triggered by 34.65.2.153 (153.2.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:13:06.647787 2026] [security2:error] [pid 25436:tid 25436] [client 34.65.2.153:47140] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.abchessboards.com.kanata.ws\|F\|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.abchessboards.com.kanata.ws"] [uri "/.codex/auth.json.old"] [unique_id "arHIEpA6LiLQLNz_Eu66kQAAADM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-09-21 22:48:09 (1 day ago)	[TueSep2200:48:05.1295562026][security2:error][pid4091037:tid4091264][client34.65.2.153:0]ModSecurit ... show more [TueSep2200:48:05.1295562026][security2:error][pid4091037:tid4091264][client34.65.2.153:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"cpcontacts.admin-services.ch\"][uri\"/.codex/auth.json.bak\"][unique_id\"arG0JUaCr2sXZX8oVelGnwAAAQg\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-09-21 18:59:28 (1 day ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇫🇷 cityhunter_rhone	2026-09-21 12:25:02 (1 day ago)	Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-09-21 14:22:22 \| hits_4 ... show more Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-09-21 14:22:22 \| hits_403=41 \| hits_404=0 \| ip=34.65.2.153 \| sample_uri=/public/.claude/credentials.json show less	Port Scan Hacking Web App Attack
🇬🇧 consul.to	2026-09-21 09:40:15 (2 days ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 Mangelot Hosting	2026-09-21 07:18:56 (2 days ago)	(modsecurity) srv104 ModSecurity 34.65.2.153 (CH/Switzerland/153.2.65.34.bc.googleusercontent.com): ... show more (modsecurity) srv104 ModSecurity 34.65.2.153 (CH/Switzerland/153.2.65.34.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇯🇵 Valhalla	2026-09-21 07:09:00 (2 days ago)	/.config/claude/credentials.json	Hacking Web App Attack
🇮🇹 VHosting	2026-09-21 05:55:04 (2 days ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.160.174.238

🇵🇪 200.37.103.36

🇺🇸 157.245.220.102

🇵🇰 103.186.77.78

🇧🇬 82.147.142.205

🇷🇺 78.29.126.253

🇺🇸 69.49.246.176

🇺🇸 65.49.1.101

🇰🇷 8.220.195.43

🇨🇱 186.189.89.181

🇳🇱 109.160.32.200

🇧🇩 103.138.190.211

🇫🇷 92.159.247.139

🇺🇸 66.132.195.82

🇧🇪 34.156.22.151

🇸🇪 31.59.160.3

🇵🇰 223.123.42.51

🇵🇰 223.123.42.49

🇨🇳 223.109.252.252

🇧🇬 212.73.158.239