Connecting

Address

34.31.120.130

Medium 10/15/30d lists

Requests for files that exist only to be stolen - .env, .git internals, configuration and database backups. A web sensor reports this after several distinct such paths from one address, never after a single 404.

Triage

Risk score

how this score is made up
Risk score29/100
Detection volume+12Sensor corroboration+5Signal class+0Recency+12
Enrichment

Address intelligence

cached
CountryUnited StatesUS
City / regionKane, Iowa, United StatesAmerica/Chicago
NetworkGoogle LLCgoogle.com
ASNAS396982
Reverse DNS130.120.31.34.bc.googleusercontent.com
Detections3total observations
Reporting sensors1distinct collectors
First seen2026-10-08 12:47 GMT+81 day ago
Last seen2026-10-08 12:47 GMT+81 day ago
Blocklist window10/15/30d lists
Attribution

Reporting sensors

which collectors observed this address
  • Web Sensor 033 observations · last 2026-10-08 12:47 GMT+8Web
Sensor names are anonymised. Collector hostnames and log contents are never published.
Signals

Observation history

1 signal record
  • Sensitive file probing over HTTPMediumWeb attack
    3 detections from 1 sensor · first seen 2026-10-08 12:47 GMT+8 · last seen 2026-10-08 12:47 GMT+8 (1 day ago) · active

    Requests for files that exist only to be stolen - .env, .git internals, configuration and database backups. A web sensor reports this after several distinct such paths from one address, never after a single 404.

Abuse Radar publishes sanitized indicators only. Severity is a triage hint computed from detection volume, sensor corroboration, signal class and recency — it is not an attribution claim. See methodology.