JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

34.85.173.253

Neutral Activity

Abuse Confidence Score

0% Low Risk

30 reports

23 reporters · latest 2 months ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 253.173.85.34.bc.googleusercontent.com
Domain Name: google.com
Country: 🇺🇸 United States of America
City: Washington, District of Columbia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

34.85.173.253 has been reported 30 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

30 from 23 distinct reporters

First reported

August 31st 2026

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 proactive-noc	2026-09-06 06:14:01 UTC · (2 months ago)	Suspicious requests detected: 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.example HTTP/2.0" 302 357 "-" "crusader-worker/1.0" 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.backup HTTP/2.0" 302 357 "-" "crusader-worker/1.0" 3 ... show more Suspicious requests detected: 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.example HTTP/2.0" 302 357 "-" "crusader-worker/1.0" 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.backup HTTP/2.0" 302 357 "-" "crusader-worker/1.0" 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.old HTTP/2.0" 302 357 "-" "crusader-worker/1.0" 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.production HTTP/2.0" 302 357 "-" "crusader-worker/1.0" 34.85.173.253 - - [01/Sep/2026:02:56:08 +0000] "GET /.env.save HTTP/2.0" 302 357 "-" "crusader-worker/1.0" ... (truncated) show less	Hacking Brute-Force
🇨🇦 polycoda	2026-09-01 09:53:32 UTC · (2 months ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based)	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-09-01 07:04:35 UTC · (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇬🇧 consul.to	2026-09-01 05:42:59 UTC · (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇸🇪 vaia.cloud	2026-09-01 05:10:05 UTC · (2 months ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 05:09:07 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 34.85.173.253 (253.173.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 01:09:01.106242 2026] [security2:error] [pid 27304:tid ... show more (mod_security) mod_security (id:210492) triggered by 34.85.173.253 (253.173.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 01:09:01.106242 2026] [security2:error] [pid 27304:tid 27304] [client 34.85.173.253:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.env.bak"] [unique_id "apZd7YpCDvjHC8D2ce_0wwAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-01 04:48:01 UTC · (2 months ago)	Bot / scanning and/or hacking attempts: GET /wp-config.php.swp HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1, GET /.env.backup HTTP/1.1, GET /actuator/configprops HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /.e ... show more Bot / scanning and/or hacking attempts: GET /wp-config.php.swp HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /storage/logs/laravel.log HTTP/1.1, GET /.env.backup HTTP/1.1, GET /actuator/configprops HTTP/1.1, GET /crusader-404-probe HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.old HTTP/1.1, GET /_ignition/health-check HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /.env.example HTTP/1.1 show less	Hacking Web App Attack
🇨🇦 Anytech	2026-09-01 03:36:37 UTC · (2 months ago)	Blocked by Conn-Monitor: env-probing	Web App Attack Hacking
🇺🇸 mnsf	2026-09-01 03:05:41 UTC · (2 months ago)	Scanning/Probing (20)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 03:00:45 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 34.85.173.253 (253.173.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 23:00:40.345981 2026] [security2:error] [pid 3601136:ti ... show more (mod_security) mod_security (id:210492) triggered by 34.85.173.253 (253.173.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 23:00:40.345981 2026] [security2:error] [pid 3601136:tid 3601296] [client 34.85.173.253:41476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joblackwell.com"] [uri "/.env.old"] [unique_id "apY_2Pld6vWye3pWxgdm6wAAAQg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 proactive-noc	2026-09-01 02:56:08 UTC · (2 months ago)	Multiple requests to well known vulnerable paths: 10	Hacking Web App Attack
Anonymous	2026-09-01 02:47:38 UTC · (2 months ago)	[01/Sep/2026:12:47:36 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 404 236 "crusader-worker/1.0" [01/Sep/2026:12:47:36 +1000] "GET /wp-config.php.swp HTTP/1.1" 403 239 "crusader-worker/1.0"	Hacking Web App Attack
Anonymous	2026-09-01 02:41:20 UTC · (2 months ago)	GET /.env.prod HTTP/1.1 ...	Web App Attack
🇩🇪 Gwyneth Llewelyn	2026-09-01 02:40:25 UTC · (2 months ago)	2026/09/01 03:40:14 [error] 380596#380596: 1974965 access forbidden by rule, client: 34.85.173.253, server: [redacted], request: "GET /.env HTTP/1.1", host: "[redacted]" 34.85.173.253 - - [01/Sep/2026:03:40:14 +0100] "GET /.env HTTP/1.1" 403 2599 "- ... show more 2026/09/01 03:40:14 [error] 380596#380596: 1974965 access forbidden by rule, client: 34.85.173.253, server: [redacted], request: "GET /.env HTTP/1.1", host: "[redacted]" 34.85.173.253 - - [01/Sep/2026:03:40:14 +0100] "GET /.env HTTP/1.1" 403 2599 "-" "crusader-worker/1.0" 2026/09/01 03:40:24 [error] 380596#380596: *1974973 access forbidden by rule, client: 34.85.173.253, server: [redacted], request: "GET //.env HTTP/1.1", host: "[redacted]" show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 02:30:49 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 34.85.173.253 (253.173.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 22:30:43.427089 2026] [security2:error] [pid 17556:tid ... show more (mod_security) mod_security (id:210492) triggered by 34.85.173.253 (253.173.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 22:30:43.427089 2026] [security2:error] [pid 17556:tid 17556] [client 34.85.173.253:33116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "opticasprisma.com"] [uri "/.env.example"] [unique_id "apY40xen5fU7nX07FEaBPAAAABs"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 200.138.46.139

🇹🇯 185.177.0.145

🇺🇸 13.220.196.131

🇺🇸 216.25.90.15

🇺🇸 147.185.132.112

🇺🇸 129.121.138.211

🇹🇼 110.25.112.152

🇺🇸 57.141.0.6

🇵🇱 2400:cb00:73:1000:8097:ca9e:178c:1f00

🇮🇹 185.168.175.118

🇳🇱 109.160.32.171

🇨🇮 102.67.220.46

🇨🇳 58.19.106.249

🇳🇱 213.209.159.238

🇨🇭 179.43.175.22

🇺🇸 173.21.51.183

🇷🇴 92.118.39.78

🇸🇪 82.96.32.68

🇩🇪 69.5.169.81

🇳🇱 64.205.72.85