This IP address has been reported a total of
28
times from
25 distinct
sources.
35.194.70.245 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
223 attacks on directory traversals, VC URLs, config grabbing URLs (type 2), env grabbing URLs, PHP ...
show more223 attacks on directory traversals, VC URLs, config grabbing URLs (type 2), env grabbing URLs, PHP URLs, env grabbing URLs (type 2), password/key grabbing URLs:
GET /..%2f..%2f.env HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /config/gcp-credentials.json HTTP/1.1
GET /.env.save HTTP/1.1
POST /icecoder/lib/file-control.php HTTP/1.1
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
show less
Hacking
Web App Attack
Anonymous
(mod_security) mod_security triggered on hostname [redacted] 35.194.70.245 (US/United States/245.70. ...
show more(mod_security) mod_security triggered on hostname [redacted] 35.194.70.245 (US/United States/245.70.194.35.bc.googleusercontent.com)
show less
SQL Injection
Anonymous
Attempted access to sensitive endpoint (/.env.supabase) detected. Automated scan or unauthorized pro ...
show moreAttempted access to sensitive endpoint (/.env.supabase) detected. Automated scan or unauthorized probing.
show less
Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ...
show moreDetected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-admin-interface-probing, http-bad-user-agent, http-cve-2021-41773, http-path-traversal-probing, http-probing, http-sensitive-files. 46 matching log events between 2026-10-21T14:51:56Z and 2026-10-22T01:18:40Z (UTC). Sample requests: GET /cache/original/%2e%2e/%2e%2e/.env -> 404; GET /.my.cnf -> 404; GET /__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc -> 404; GET /@fs/../.env?raw?? -> 404; GET /@fs/proc/self/cwd/.env?raw?? -> 404; GET /@fs/proc/self/cmdline?raw?? -> 404; GET /@fs/../.env?import&raw?? -> 404; GET /admin/.env -> 404; GET /admin/settings -> 404; GET /dashboard/admin -> 404; GET /.env.save -> 404; GET /backend/.env -> 404; GET /web/.env -> 404; GET /frontend/.env -> 404; GET /.env.prod -> 404; GET /robots.txt -> 404; GET /static/manifest.json -> 404; GET /webpack-stats.json -> 404; GET /dist/manifest.json -> 404; GET /asset-manifest.json -> 404
show less
{"level":"info","ts":1792629156.5939746,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1792629156.5939746,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.194.70.245","remote_port":"53658","client_ip":"35.194.70.245","proto":"HTTP/2.0","method":"GET","host":"status.shopforless.net","uri":"/.env.production?import&raw","headers":{"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)"],"Accept":["*/*"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.shopforless.net","ech":false}},"bytes_read":0,"user_id":"","duration":0.000106323,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After"
...
show less
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-21 17:39 UTC. Samples: ...
show moreExploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-21 17:39 UTC. Samples: GET /dist/.vite/manifest.json 444; GET /.vite/manifest.json 444; GET /frontend/.env 444. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like. Detected by fail2ban.
show less