This IP address has been reported a total of
10
times from
10 distinct
sources.
35.196.245.61 was first reported on
March 25th 2026 , and the most recent report was
5 days ago Germany
with 2
reports;
Netherlands
with 2
reports;
Canada
with 1
report.
The most common categories in these recent reports were:
Web App Attack
6
times;
Brute-Force
4
times;
Bad Web Bot
3
times;
Hacking
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇨🇦
john doe
2026-09-22 12:02:51
(5 days ago)
SentinelBot: Secret-path hunting (5 distinct paths): Env File Hunting, Backup File Hunt (score: 68)
Bad Web Bot
🇫🇷
masterguru
2026-09-22 11:44:36
(5 days ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-195)
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-22 11:34:14
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 35.196.245.61 (61.245.196.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.196.245.61 (61.245.196.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 07:34:08.522738 2026] [security2:error] [pid 13716:tid 13748] [client 35.196.245.61:48526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chilltech.info"] [uri "/wp-config.php.swp"] [unique_id "arJnsKJdpEbRpM-GHp_1cwAAAQ8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-22 11:27:03
(5 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
ghostwarriors
2026-09-22 10:50:11
(5 days ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-09-22 10:40:04
(5 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-09-22 10:35:22
(5 days ago)
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-10al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.196.245.61 - - [22/Sep/2026:12:35:08 +0200] "GET /wp-config.php.bak HTTP/1.1" 403 6080 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
yitzhaq
2026-09-22 10:30:40
(5 days ago)
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4586 "-" "crusader ...
show more
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /wp-config.php~ HTTP/1.1" 404 4586 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 4586 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /.env.prod HTTP/1.1" 404 4586 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /crusader-404-probe HTTP/1.1" 404 4586 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /.env HTTP/1.1" 404 4587 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /.env.old HTTP/1.1" 404 4587 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /wp-config.php.swp HTTP/1.1" 404 4586 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /_ignition/health-check HTTP/1.1" 404 4586 "-" "crusader-worker/1.0"
35.196.245.61 - - [22/Sep/2026:12:30:37 +0200] "GET /actuator/configprops HTTP/1.1" 404 4587 "-" "c
show less
Web App Attack
Brute-Force
🇺🇸
xmission.com
2026-03-25 21:20:27
(6 months ago)
Blocked 26 connection attempts due to Spamhaus RBL (RJCT05) in the past 4 hours. To request delistin ...
show more
Blocked 26 connection attempts due to Spamhaus RBL (RJCT05) in the past 4 hours. To request delisting, visit https://www.spamhaus.org/lookup/ to check your IP status and submit a delist request if eligible.
show less
Email Spam
🇳🇱
Cloud86 B.V.
2026-03-25 20:39:06
(6 months ago)
categories: Email Spam
Email Spam
Showing 1 to
10
of 10 reports
