JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

35.198.9.238

Activity Trending Down

Abuse Confidence Score

85% Critical

30 reports

26 reporters · latest 2 weeks ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 238.9.198.35.bc.googleusercontent.com
Domain Name: google.com
Country: 🇧🇷 Brazil
City: Sao Paulo, Sao Paulo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

30 from 26 distinct reporters

First reported

October 26th 2026

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇳🇱 Netherlands 6 🇩🇪 Germany 4 🇬🇧 United Kingdom of Great Britain and Northern Ireland 4

Most common categories Web App Attack 26 Brute-Force 10 Bad Web Bot 9 Hacking 8 SSH 1

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-10-28 23:16:43 UTC · (2 weeks ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing	Bad Web Bot Web App Attack
Anonymous	2026-10-28 10:14:03 UTC · (2 weeks ago)	Bot / scanning and/or hacking attempts: GET /private/.env HTTP/1.1, GET /server/.env HTTP/1.1, GET /application/.env HTTP/1.1, GET /core/.env HTTP/1.1, GET /.env.yml HTTP/1.1, GET /src/.env HTTP/1.1, GET /app/.env HTTP/1.1, GET /core/app/.env HTTP/1. ... show more Bot / scanning and/or hacking attempts: GET /private/.env HTTP/1.1, GET /server/.env HTTP/1.1, GET /application/.env HTTP/1.1, GET /core/.env HTTP/1.1, GET /.env.yml HTTP/1.1, GET /src/.env HTTP/1.1, GET /app/.env HTTP/1.1, GET /core/app/.env HTTP/1.1, GET /.env.json HTTP/1.1, GET /config/.env HTTP/1.1, GET /frontend/.env HTTP/1.1 show less	Hacking Web App Attack
🇫🇮 paissangroup	2026-10-28 04:09:52 UTC · (2 weeks ago)	Multiple WAF Violations	Web App Attack
🇧🇪 cmbplf	2026-10-28 03:22:42 UTC · (2 weeks ago)	1.056 requests with url.path .env 153 requests with url.path phpinfo.php	Brute-Force Bad Web Bot
Anonymous	2026-10-27 23:12:44 UTC · (2 weeks ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-27 19:31:57 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 35.198.9.238 (238.9.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 15:31:52.194716 2026] [security2:error] [pid 18176:tid 18 ... show more (mod_security) mod_security (id:210492) triggered by 35.198.9.238 (238.9.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 15:31:52.194716 2026] [security2:error] [pid 18176:tid 18176] [client 35.198.9.238:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.earscript.net"] [uri "/.git/config"] [unique_id "auD8KPvVk31Z2LuA3w8OwAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-10-27 18:33:28 UTC · (2 weeks ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇬🇧 WebNiraj	2026-10-27 13:38:01 UTC · (2 weeks ago)	(mod_security) mod_security (id:949110) triggered by 35.198.9.238 (BR/Brazil/238.9.198.35.bc.googleusercontent.com): 5 in the last 3600 secs [SIGMA]	Brute-Force
🇸🇪 vaia.cloud	2026-10-27 12:35:01 UTC · (2 weeks ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇫🇷 Octopuce	2026-10-27 06:31:23 UTC · (2 weeks ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇫🇷 dynamix	2026-10-27 06:12:20 UTC · (2 weeks ago)	Multiple WAF Violations	Web App Attack
🇬🇧 dwmosaics	2026-10-27 02:34:24 UTC · (2 weeks ago)	"GET /.env.local HTTP/1.1" 301 682 "-" "Mozilla/5.0 (Macintosh; Intel Mac O...	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-10-27 01:18:50 UTC · (2 weeks ago)	(mod_security) mod_security (id:949110) triggered by 35.198.9.238 (238.9.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:18:45.353460 2026] [security2:error] [pid 1066:tid 106 ... show more (mod_security) mod_security (id:949110) triggered by 35.198.9.238 (238.9.198.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:18:45.353460 2026] [security2:error] [pid 1066:tid 1066] [client 35.198.9.238:52520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dw.cescfoundation.org"] [uri "/.git/config"] [unique_id "at_79dSm8rwaUR7SqWb83AAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-26 23:26:53 UTC · (2 weeks ago)	Probing for exposed secret / credential files	Hacking Web App Attack
🇬🇧 consul.to	2026-10-26 23:08:12 UTC · (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇦 91.207.245.249

🇺🇦 37.221.139.115

🇺🇸 35.202.177.227

🇺🇸 185.45.195.22

🇨🇦 167.114.158.210

🇺🇸 162.216.150.247

🇲🇽 148.230.154.182

🇨🇳 116.16.131.13

🇳🇱 77.239.124.41

🇫🇷 75.119.145.108

🇺🇸 67.9.126.54

🇺🇸 2604:a880:400:d1:0:5:6dae:4001

🇳🇱 200.138.46.82

🇷🇴 82.152.132.24

🇺🇸 67.175.117.52

🇺🇸 51.8.102.121

🇭🇰 43.154.195.142

🇺🇸 34.30.149.229

🇺🇦 31.129.79.58

🇲🇾 175.141.243.58