This IP address has been reported a total of
29
times from
22 distinct
sources.
35.199.113.193 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 6
reports;
Netherlands
with 6
reports;
United Kingdom of Great Britain and Northern Ireland
with 3
reports.
The most common categories in these recent reports were:
Web App Attack
21
times;
Bad Web Bot
8
times;
Brute-Force
7
times;
SQL Injection
5
times;
Hacking
4
times;
Other
5
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Investigation Report
Multiple Web Recon/Attacks from 35.199.113.193
Description: Repeated activity ...
show moreInvestigation Report
Multiple Web Recon/Attacks from 35.199.113.193
Description: Repeated activity indicative of reconnaissance looking for vulnerabilities and/or weaknesses.
show less
Web App Attack
Anonymous
(mod_security) mod_security triggered on hostname [redacted])
Ip 35.199.113.193 performed 'crowdsecurity/http-sensitive-files' (5 events over 308.181207ms) at 202 ...
show moreIp 35.199.113.193 performed 'crowdsecurity/http-sensitive-files' (5 events over 308.181207ms) at 2026-10-02 10:01:08.319445279 +0000 UTC
show less
Web vulnerability scanning: probing for exposed sensitive files (.env). Detected and blocked automat ...
show moreWeb vulnerability scanning: probing for exposed sensitive files (.env). Detected and blocked automatically.
show less
{"level":"info","ts":1790930909.72997,"logger":"http.log.access.log2","msg":"handled request","reque ...
show more{"level":"info","ts":1790930909.72997,"logger":"http.log.access.log2","msg":"handled request","request":{"remote_ip":"35.199.113.193","remote_port":"33464","client_ip":"35.199.113.193","proto":"HTTP/2.0","method":"GET","host":"notifications.joshseveros.cloud","uri":"/.env.local?import&raw","headers":{"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)"],"Accept":["*/*"],"Accept-Encoding":["gzip"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"notifications.joshseveros.cloud"}},"bytes_read":0,"user_id":"","duration":0.000908804,"size":51,"status":404,"resp_headers":{"Access-Control-Allow-Origin":["*"],"Content-Type":["application/json"],"Date":["
...
show less
(mod_security) mod_security triggered on hostname [redacted] 35.199.113.193 (BR/Brazil/193.113.199.3 ...
show more(mod_security) mod_security triggered on hostname [redacted] 35.199.113.193 (BR/Brazil/193.113.199.35.bc.googleusercontent.com): (CF_ENABLE)
show less
CrowdSec scenario: crowdsecurity/http-sensitive-files. Banned by Koru Cloud platform after multi-eve ...
show moreCrowdSec scenario: crowdsecurity/http-sensitive-files. Banned by Koru Cloud platform after multi-event detection. ASN: GOOGLE-CLOUD-PLATFORM. Country: BR. Timestamp: 2026-10-02T08:17:03+00:00.
show less
{"level":"info","ts":1790924441.885843,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more{"level":"info","ts":1790924441.885843,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.199.113.193","remote_port":"38274","client_ip":"35.199.113.193","proto":"HTTP/2.0","method":"GET","host":"uptime.lil01fr.vsys.cloud","uri":"/manifest.json","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Dest":["document"],"X-Nextjs-Data":["1"],"Sec-Ch-Ua-Mobile":["?0"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Priority":["u=0, i"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Fetch-User":["?1"],"Sec-Ch-Ua":["\"Chr
...
show less
Credential/config file harvesting. 50 request(s) against help.dispensight.cloud between 2026-10-02 0 ...
show moreCredential/config file harvesting. 50 request(s) against help.dispensight.cloud between 2026-10-02 00:16 and 2026-10-02 00:16 (America/Vancouver). Sample paths: /.env?.svg?.wasm?init; /.env.local?import&raw; /.env?import&raw. Observed on origin web logs + tunnel telemetry. Automated detection, manually reviewed. Reported by Dispensight/SecureLeaf.
show less
