This IP address has been reported a total of
14
times from
13 distinct
sources.
35.201.140.190 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
ban-reviewer auto report; ip=35.201.140.190; scenario=custom/kgateway-auth-client-error-burst; verdi ...
show moreban-reviewer auto report; ip=35.201.140.190; scenario=custom/kgateway-auth-client-error-burst; verdict=valid_ban; confidence=0.92; categories=15; active_decisions=3; lookback_decisions=3; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high; ip_active_decision_count_high
show less
{"level":"info","ts":1791500115.712701,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more{"level":"info","ts":1791500115.712701,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.201.140.190","remote_port":"50832","client_ip":"35.201.140.190","proto":"HTTP/2.0","method":"GET","host":"hosted.rikr.tech","uri":"/webpack-stats.json","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Fetch-Site":["none"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Accept-Language":["en-US,en;q=0.9"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Dest":["document"],"Sec-Ch-Ua":["\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\""],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Priority":["u=0, i"],"Accept-Encoding"
...
show less
| [Dangerous/Taiwan] Aggressive IP 35.201.140.190 (~30 hits). Type: DoS Defender- Web server 400 err ...
show more| [Dangerous/Taiwan] Aggressive IP 35.201.140.190 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Ran a ~70-request secret/credential/webshell scan against a public web host in ~12 seconds - PHP fil ...
show moreRan a ~70-request secret/credential/webshell scan against a public web host in ~12 seconds - PHP filter-wrapper RCE attempts, .env/SSH-key/cloud-credential file probes, Kubernetes-token and Vite source-map path traversal - mostly rejected (404/400). The php://input POST to /index.php returned 200...
Target: HTTP/HTTPS 80 and 443 (public web host): POST of PHP filter-wrapper payloads (allow_url_include=on, auto_prepend_file=php://input); GET of .env/.a host, /.ssh/id_rsa, /.aws/credentials, /service-ac...
Seen: 2026-10-08 11:52 EDT
- 2026-10-08 11:52:42 POST /index.php with -d allow_url_include=on -d auto_prepend_file=php://input HTTP/2.0 -> 200 (PHP filter-wrapper RCE attempt)
- 2026-10-08 11:52:44 POST /cgi-bin/php with allow_url_include/auto_prepend_file=php://input HTTP/2.0 -> 404 (PHP wrapper RCE attempt)
- 2026-10-08 11:52:36 GET /.ssh/id_rsa HTTP/2.0 -> 403 (SSH private-key harvest attempt)
- 2026-10-08 11:52:33 GET /.aws/credentials HTTP/2.0 -> 403 (AWS credential-file probe)
show less
Web App Attack
Showing 1 to
14
of 14 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩