JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

134.209.9.35

Activity Trending Down

Abuse Confidence Score

100% Critical

90 reports

79 reporters · latest 1 week ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: Santa Clara, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

90 from 79 distinct reporters

First reported

August 13th 2025

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇩🇪 Germany 30 🇺🇸 United States of America 19 🇫🇷 France 8

Most common categories Web App Attack 66 Bad Web Bot 22 Brute-Force 16 Hacking 13 Port Scan 7

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇪 Coolnagour	2026-11-05 10:12:21 UTC · (1 week ago)	http-probing: /phpinfo	Web App Attack
🇺🇸 stvnrdg.me	2026-11-05 03:31:58 UTC · (1 week ago)	134.209.9.35 - - [05/Nov/2026:03:31:57 +0000] "GET //.env.php HTTP/1.1" 404 561 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ...	Hacking
🇨🇭 4server	2026-11-05 03:18:16 UTC · (1 week ago)	[ThuNov0504:18:11.9029302026][security2:error][pid192550:tid192738][client134.209.9.35:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOC ... show more [ThuNov0504:18:11.9029302026][security2:error][pid192550:tid192738][client134.209.9.35:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"hostingedominio.com\"][uri\"/.aws/config\"][unique_id\"auv1c4IWtzAuBkfuvbsuPAAAARM\"] show less	Hacking Web App Attack
🇬🇧 consul.to	2026-11-05 03:01:49 UTC · (1 week ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 factor1	2026-11-05 02:08:43 UTC · (1 week ago)	CrowdSec at apollo Reports Abuse	Web App Attack
🇺🇸 chrisj	2026-11-05 02:04:34 UTC · (1 week ago)	[Thu Nov 05 02:02:17.608880 2026] [proxy_fcgi:error] [pid 74516:tid 74618] [client 134.209.9.35:41742] AH01071: Got error 'Primary script unknown' [Thu Nov 05 02:04:24.665186 2026] [proxy_fcgi:error] [pid 74514:tid 74599] [client 134.209.9.35:33790] ... show more [Thu Nov 05 02:02:17.608880 2026] [proxy_fcgi:error] [pid 74516:tid 74618] [client 134.209.9.35:41742] AH01071: Got error 'Primary script unknown' [Thu Nov 05 02:04:24.665186 2026] [proxy_fcgi:error] [pid 74514:tid 74599] [client 134.209.9.35:33790] AH01071: Got error 'Primary script unknown' [Thu Nov 05 02:04:34.024257 2026] [proxy_fcgi:error] [pid 74516:tid 74583] [client 134.209.9.35:42106] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇨🇿 SystemAdmin	2026-11-05 01:59:38 UTC · (1 week ago)	Doing bad things...	Web App Attack
🇦🇺 Bay13	2026-11-04 23:48:13 UTC · (1 week ago)	CrowdSec:custom/http-sensitive-files	Web App Attack
🇫🇮 paissangroup	2026-11-04 22:56:45 UTC · (1 week ago)	Multiple WAF Violations	Web App Attack
🇺🇸 kosada.com	2026-11-04 22:46:35 UTC · (1 week ago)	Repeated requests for suspicious nonexistent URLs, for example: //.env.prod (HTTP/1.1 port 443, user agent: "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Sa ... show more Repeated requests for suspicious nonexistent URLs, for example: //.env.prod (HTTP/1.1 port 443, user agent: "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36") show less	Web App Attack
🇫🇷 regishoussin	2026-11-04 20:41:46 UTC · (1 week ago)	Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-11-04 20:41 UTC.	Bad Web Bot Web App Attack
🇩🇪 8legz.net	2026-11-04 18:50:39 UTC · (1 week ago)	[Wed Nov 04 18:49:09.400561 2026] [php:error] [pid 3197] [client 134.209.9.35:52792] script '/var/www/html/.env.php' not found or unable to stat [Wed Nov 04 18:50:34.969340 2026] [php:error] [pid 8361] [client 134.209.9.35:33188] script '/var/www/htm ... show more [Wed Nov 04 18:49:09.400561 2026] [php:error] [pid 3197] [client 134.209.9.35:52792] script '/var/www/html/.env.php' not found or unable to stat [Wed Nov 04 18:50:34.969340 2026] [php:error] [pid 8361] [client 134.209.9.35:33188] script '/var/www/html/php.php' not found or unable to stat [Wed Nov 04 18:50:38.585178 2026] [php:error] [pid 10703] [client 134.209.9.35:51854] script '/var/www/html/phpinfo.php' not found or unable to stat ... show less	Brute-Force
🇺🇸 jkhorvath	2026-11-04 15:55:08 UTC · (1 week ago)	Request for URL /.env.live	Phishing Brute-Force Web App Attack
🇳🇱 Alt255	2026-11-04 15:47:32 UTC · (1 week ago)	[topuurbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 134.209.9.35 - - \[04/Nov/2026:16:47:21 +0100\] "GET //.env.live HTTP/1.1" 301 598 "-" "Mozlila/5.0 \(Linux\; Android 7.0\; SM-G892A Bulid/NRD90M\; wv\) ... show more [topuurbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 134.209.9.35 - - \[04/Nov/2026:16:47:21 +0100\] "GET //.env.live HTTP/1.1" 301 598 "-" "Mozlila/5.0 \(Linux\; Android 7.0\; SM-G892A Bulid/NRD90M\; wv\) AppleWebKit/537.36 \(KHTML, like Gecko\) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 McClay	2026-11-04 15:14:53 UTC · (1 week ago)	HTTP-404 spam:134.209.9.35 - - [04/Nov/2026:16:14:17 +0100] "GET //.env.live HTTP/1.1" 404 1051 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537 ... show more HTTP-404 spam:134.209.9.35 - - [04/Nov/2026:16:14:17 +0100] "GET //.env.live HTTP/1.1" 404 1051 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 134.209.9.35 - - [04/Nov/2026:16:14:23 +0100] "GET //.env.local HTTP/1.1" 404 1051 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 134.209.9.35 - - [04/Nov/2026:16:14:25 +0100] "GET //.env.old HTTP/1.1" 404 1051 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 134.209.9.35 - - [04/Nov/2026:16:14:30 +0100] "GET //.env.php HTTP/1.1" 404 246 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 134.209.9.35 - - [04/Nov/2026:16:14:31 ... show less	Web App Attack

Showing 1 to 15 of 90 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇬 161.120.172.166

🇺🇸 68.44.42.168

🇫🇮 46.29.26.203

🇰🇷 20.214.165.240

🇮🇳 157.245.108.6

🇨🇳 118.145.107.219

🇧🇭 109.161.196.135

🇳🇬 105.113.85.195

🇧🇩 103.41.244.128

🇩🇪 2.26.18.76

🇵🇱 2400:cb00:1055:1000:c2f6:a9b8:9249:e28d

🇲🇾 202.188.35.124

🇮🇶 169.224.86.235

🇺🇸 66.80.28.68

🇩🇪 64.89.163.94

🇳🇱 34.178.173.159

🇺🇸 3.129.187.38

🇳🇱 193.47.62.69

🇯🇵 160.251.255.178

🇪🇨 157.100.66.122