This IP address has been reported a total of
70
times from
58 distinct
sources.
35.194.144.85 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated secret-file probing: 290 requests 2026-10-12 to 10-15 for .env variants, .git/config, SSH ...
show moreAutomated secret-file probing: 290 requests 2026-10-12 to 10-15 for .env variants, .git/config, SSH private keys, cloud credential files (.aws, .s3cfg, .dockercfg) and Spring actuator endpoints, including path-traversal variants (..;/, %2e%2e). Rotates spoofed search/AI crawler user agents (GPTBot, CCBot, Amazonbot, Baiduspider, KimiBot) and generic Chrome 131. Part of a coordinated pool of 100+ cloud IPs.
show less
601 requests with url.path */@fs/*
327 requests with url.path */proc/*
198 requests with url.path ...
show more601 requests with url.path */@fs/*
327 requests with url.path */proc/*
198 requests with url.path *.ssh/*
146 requests with url.path *.aws/*
138 requests with url.path *credentials.json
133 requests with url.path *config.json
show less
CrowdSec blocked IP for crowdsecurity/http-probing on localhost
Web App Attack
Anonymous
Bot / scanning and/or hacking attempts: GET /.git-credentials HTTP/2.0, GET /secrets.json HTTP/2.0, ...
show moreBot / scanning and/or hacking attempts: GET /.git-credentials HTTP/2.0, GET /secrets.json HTTP/2.0, POST /login HTTP/2.0, GET /wrangler.toml HTTP/2.0, GET /.env.example HTTP/2.0, GET /.cache/huggingface/token HTTP/2.0, GET /.npmrc HTTP/2.0, GET /vercel.json HTTP/2.0, GET /.dev.vars HTTP/2.0, GET /netlify.toml HTTP/2.0, GET /secrets.env HTTP/2.0, GET /.aws/credentials HTTP/2.0, GET /.git/config HTTP/2.0, GET /.htpasswd HTTP/2.0, GET /.git/HEAD HTTP/2.0, GET /secrets.yml HTTP/2.0, GET /.env.bak HTTP/2.0, POST /api HTTP/2.0, GET /.ssh/config HTTP/2.0, GET /.env.local HTTP/2.0, GET /supabase/.env HTTP/2.0, GET /.env.backup HTTP/2.0
show less
Honeypot caught: //.env via admin.saec.me. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; co ...
show moreHoneypot caught: //.env via admin.saec.me. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected]).
show less
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
IoT Targeted