JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

35.199.121.245

Neutral Activity

Abuse Confidence Score

0% Low Risk

66 reports

48 reporters · latest 2 months ago

ISP: Google LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS396982
Hostname(s): 245.121.199.35.bc.googleusercontent.com
Domain Name: google.com
Country: 🇧🇷 Brazil
City: Sao Paulo, Sao Paulo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

35.199.121.245 has been reported 66 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

66 from 48 distinct reporters

First reported

September 1st 2026

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 SwinT	2026-09-05 14:00:04 UTC · (2 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇬🇷 setupgr	2026-09-05 12:23:36 UTC · (2 months ago)	(mod_security) mod_security (id:11000011) triggered by 35.199.121.245 (BR/Brazil/SÃ£o Paulo/SÃ£o Paulo/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Sep 05 15:23:35.363695 2 ... show more (mod_security) mod_security (id:11000011) triggered by 35.199.121.245 (BR/Brazil/SÃ£o Paulo/SÃ£o Paulo/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Sep 05 15:23:35.363695 2026] [security2:error] [pid 3078:tid 3213] [client 35.199.121.245:37702] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 245.121.199.35.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "www.cpanagiotou.gr"] [uri "/"] [unique_id "apwJxwLAPckMk63T65EEhQAAA4g"] show less	Port Scan
Anonymous	2026-09-05 09:18:12 UTC · (2 months ago)	FortiWeb WAF: 300 attacks detected. Threat Score: 54000. Types: Client Management(150), Block IP List(150). Origin: Brazil.	Web App Attack
🇺🇸 paulo.apoloni	2026-09-05 08:10:17 UTC · (2 months ago)	35.199.121.245 - - [05/Sep/2026:05:10:16 -0300] "GET /.env.local HTTP/1.1" 404 22 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [05/Sep/2026:05:10:16 -0300] "GET /.env.p ... show more 35.199.121.245 - - [05/Sep/2026:05:10:16 -0300] "GET /.env.local HTTP/1.1" 404 22 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [05/Sep/2026:05:10:16 -0300] "GET /.env.production HTTP/1.1" 404 22 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [05/Sep/2026:05:10:16 -0300] "GET /.env.staging HTTP/1.1" 404 22 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [05/Sep/2026:05:10:17 -0300] "GET /.env.development HTTP/1.1" 404 22 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [05/Sep/2026:05:10:17 -0300] "GET /.env.test HTTP/1.1" 404 22 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 Phenix Info	2026-09-05 03:16:43 UTC · (2 months ago)	SmallGuard.fr/Prestashop Massive 403	Web App Attack
🇬🇧 consul.to	2026-09-05 03:02:37 UTC · (2 months ago)	Web attack/malicious scanning detected	Web App Attack
Anonymous	2026-09-04 15:03:16 UTC · (2 months ago)	35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "POS ... show more 35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "GET /.git/config HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.199.121.245 - - [04/Sep/2026:17:03:13 +0200] "GET /.env HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 ... show less	Bad Web Bot Web App Attack
🇩🇪 paissangroup	2026-09-04 14:39:01 UTC · (2 months ago)	Multiple WAF Violations	Web App Attack
🇳🇱 Site.eu	2026-09-04 14:23:21 UTC · (2 months ago)	Excessive multi-domain requests	Brute-Force
🇮🇹 CoreTech srl	2026-09-04 14:03:01 UTC · (2 months ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact	Hacking
Anonymous	2026-09-04 06:07:02 UTC · (2 months ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing	Bad Web Bot Web App Attack
🇩🇪 4server	2026-09-04 03:33:17 UTC · (2 months ago)	[FriSep0405:33:10.6898142026][security2:error][pid3788887:tid3788915][client35.199.121.245:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htac ... show more [FriSep0405:33:10.6898142026][security2:error][pid3788887:tid3788915][client35.199.121.245:0]ModSecurity:Accessdeniedwithcode403\(phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.danielasilvia.ch.136-243-54-122.cpanel.site\"][uri\"/.env.bak\"][unique_id\"apo79hbGT8WmAD2259n2uwAAABE\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-09-03 22:04:34 UTC · (2 months ago)	(mod_security) mod_security triggered on hostname [redacted] 35.199.121.245 (BR/Brazil/245.121.199.35.bc.googleusercontent.com)	SQL Injection
Anonymous	2026-09-03 18:14:12 UTC · (2 months ago)	Bot / seems abusive / Apache connections: 25	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇫🇮 Shaik Sai Meera	2026-09-03 15:40:11 UTC · (2 months ago)	IM360 WAF: Hidden file access	Brute-Force

Showing 1 to 15 of 66 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2001:470:1:c84::25b

🇳🇱 213.209.159.26

🇨🇭 209.99.190.186

🇧🇷 189.52.52.162

🇦🇷 172.68.216.140

🇮🇩 158.140.170.124

🇺🇸 152.32.233.100

🇫🇮 130.49.11.81

🇨🇳 111.22.163.209

🇮🇳 106.196.10.189

🇮🇩 103.76.109.83

🇵🇱 83.168.105.153

🇧🇬 79.124.58.22

🇨🇳 58.222.72.182

🇷🇴 2.57.122.168

🇨🇳 2408:8207:6044:2740:6da5:5bb0:3ec4:a21d

🇺🇸 206.189.227.33

🇻🇪 186.88.159.139

🇺🇸 184.186.73.74

🇩🇪 172.71.148.181