JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 34.65.228.221

34.65.228.221 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	221.228.65.34.bc.googleusercontent.com
Domain Name	google.com
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 34.65.228.221

Whois 34.65.228.221

IP Abuse Reports for 34.65.228.221:

This IP address has been reported a total of 36 times from 25 distinct sources. 34.65.228.221 was first reported on August 31st 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-01 13:59:21 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:59:15.268501 2026] [security2:error] [pid 25619:tid 25619] [client 34.65.228.221:40580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sekizinci.com"] [uri "/.env"] [unique_id "apbaM4ytRGVBXOkRg98KYwAAACk"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 Saec	2026-09-01 13:00:11 (8 hours ago)	Jarvis auto-ban: CF top attacker on saec.me (26 hits, CH)	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 11:03:49 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:03:44.348097 2026] [security2:error] [pid 26843:tid 26843] [client 34.65.228.221:41744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.register-yacht-belgium.com"] [uri "/.env.prod"] [unique_id "apaxEHxPzWyVFzqSyDMF3AAAAEA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 AutosOnShow	2026-09-01 10:36:04 (10 hours ago)	blocked for webapp attack \| path requested: / \| seen at 2026-09-01 10:35:37.954 \|	Web App Attack
🇫🇷 masterguru	2026-09-01 10:01:33 (11 hours ago)	URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ ... show more URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-196) show less	Hacking
🇳🇱 SysAdmin Dylan	2026-09-01 09:47:07 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (CH/Switzerland/221.228.65.34.bc. ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (CH/Switzerland/221.228.65.34.bc.googleusercontent.com): 10 in the last 3600 secs show less	Brute-Force
🇫🇮 paissangroup	2026-09-01 09:19:55 (12 hours ago)	Multiple WAF Violations	Web App Attack
🇫🇷 mrcrassi	2026-09-01 09:15:58 (12 hours ago)	Triggered Cloudflare WAF (firewallManaged) from CH. Action taken: BLOCK Protocol: HTTP/1.1 (GET meth ... show more Triggered Cloudflare WAF (firewallManaged) from CH. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /wp-config.php.bak UA: crusader-worker/1.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 raph	2026-09-01 08:49:04 (12 hours ago)	[DOT FILES] crawler .env, .git, .config, etc.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 08:23:40 (13 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:23:33.599504 2026] [security2:error] [pid 226456:tid 226593] [client 34.65.228.221:36646] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marinkovich.biz"] [uri "/wp-config.php.bak"] [unique_id "apaLhSrdEraH6Tx-Bu-YogAAARY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 08:07:04 (13 hours ago)	Automated web scanner. Requested suspicious paths: /.env.local \| /crusader-404-probe \| /.env.bak \| / ... show more Automated web scanner. Requested suspicious paths: /.env.local \| /crusader-404-probe \| /.env.bak \| /.env.backup \| /.env.example \| /actuator/configprops \| /_ignition/health-check \| /.env \| /.env.save \| /env, /actuator/env \| /crusader-404-probe \| /.env.bak \| /.env.backup \| /.env.example \| /actuator/configprops \| /_ignition/health-check \| /.env \| /.env.save \| /env. UTC: 2026-09-01 07:25:00. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 07:06:02 (14 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 03:05:54.180222 2026] [security2:error] [pid 25838:tid 25856] [client 34.65.228.221:56234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "miraclearts.com"] [uri "/.env.local"] [unique_id "apZ5UjiAK0m6ICQJU9O8CQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 06:45:46 (14 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:45:42.618508 2026] [security2:error] [pid 3834:tid 3834] [client 34.65.228.221:39654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iam.zombiekillabob.com"] [uri "/.env.bak"] [unique_id "apZ0lvWebJ4c4dAdLuukyAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 06:11:37 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 34.65.228.221 (221.228.65.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 02:11:29.884766 2026] [security2:error] [pid 21281:tid 21281] [client 34.65.228.221:55648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mac136.org"] [uri "/wp-config.php.swp"] [unique_id "apZskYK6EQxppa8qecUWzAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 05:30:02 (15 hours ago)	suspicious request in access.log	Web App Attack

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 35.194.131.28

🇰🇷 211.185.133.205

🇫🇮 193.32.204.199

🇯🇵 160.251.182.78

🇺🇸 146.190.127.141

🇺🇸 35.171.117.160

🇺🇸 107.22.139.7

🇸🇪 84.13.136.9

🇬🇧 35.203.211.101

🇺🇸 20.106.21.74

🇦🇺 203.220.182.51

🇸🇪 171.25.158.82

🇺🇸 147.185.132.141

🇺🇸 143.14.6.41

🇨🇳 115.190.149.134

🇨🇳 111.18.17.102

🇷🇺 78.139.95.89

🇱🇹 77.90.185.94

🇲🇾 49.124.152.225

🇨🇳 39.73.0.25