JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

35.204.116.138

Recent Activity

Abuse confidence score ?

100% Critical

45 reports

36 reporters · latest 23 hours ago

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	138.116.204.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇳🇱 Netherlands
City	Groningen, Groningen

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 35.204.116.138

Export CSV

This IP address has been reported a total of 45 times from 36 distinct sources. 35.204.116.138 was first reported on October 13th 2026, and the most recent report was 23 hours ago. In the last 60 days, the top reporter locations were: Netherlands with 15 reports; Germany with 10 reports; Czechia with 4 reports. The most common categories in these recent reports were: Web App Attack 33 times; Bad Web Bot 13 times; Brute-Force 11 times; Hacking 10 times; Exploited Host 3 times; Other 12 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-10-18 03:39:13 (23 hours ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 Site.eu	2026-10-15 08:05:13 (3 days ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-10-15 04:33:54 (3 days ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇳🇱 homeshowdomain.nl	2026-10-14 22:04:17 (4 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-13. show less	Web App Attack SSH Hacking
🇬🇧 openstrike.co.uk	2026-10-14 05:14:27 (4 days ago)	16 attacks on password/key grabbing URLs: GET /.ssh/id_ecdsa HTTP/1.1	Hacking
Anonymous	2026-10-14 03:42:53 (4 days ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇨🇱 Fernando Soto	2026-10-14 03:05:35 (5 days ago)	WAF propio vps1 (CL): sensMASx195 score 32 en 1h. sondeo rutas sensibles.	Web App Attack
🇩🇪 FeG Deutschland	2026-10-14 02:24:05 (5 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1248	Exploited Host Web App Attack
🇩🇪 mbch	2026-10-13 23:24:09 (5 days ago)	Observed automated probing of web application/configuration paths over completed HTTP requests. UTC ... show more Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-10-13T23:24:09.121000+00:00 to 2026-10-13T23:24:09.235000+00:00: 10 distinct paths in 0.114s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /dist/manifest.json, /server/.env, /docker/.env, /app/.env, /web/.env, /public/.env, /src/.env, /dist/.env, /backend/.env, /graphql. MediaBurg website operations. show less	Web App Attack
Anonymous	2026-10-13 22:59:31 (5 days ago)	[Tue Oct 13 16:21:17.591480 2026] [authz_core:error] [pid 2385333:tid 2385385] [remote 35.204.116.13 ... show more [Tue Oct 13 16:21:17.591480 2026] [authz_core:error] [pid 2385333:tid 2385385] [remote 35.204.116.138:52704] AH01630: client denied by server configuration: /var/www/_live/data.csabazar.hu/html/ [Tue Oct 13 16:21:17.651914 2026] [authz_core:error] [pid 2385333:tid 2385390] [remote 35.204.116.138:52704] AH01630: client denied by server configuration: /var/www/_live/data.csabazar.hu/html/robots.txt [Tue Oct 13 16:21:17.692674 2026] [authz_core:error] [pid 2385333:tid 2385381] [remote 35.204.116.138:52704] AH01630: client denied by server configuration: /var/www/_live/data.csabazar.hu/html/adi2k7381dmf1wdofmw6 [Tue Oct 13 16:21:17.692690 2026] [authz_core:error] [pid 2385333:tid 3463231] [remote 35.204.116.138:52704] AH01630: client denied by server configuration: /var/www/_live/data.csabazar.hu/html/settings [Tue Oct 13 16:21:17.692803 2026] [authz_core:error] [pid 2385333:tid 2385369] [remote 35.204.116.138:52704] AH01630: client denied by server configuration: /var/www/_live/data.csaba ... show less	Brute-Force Web App Attack
🇫🇮 NoaQT	2026-10-13 22:54:57 (5 days ago)	2026-10-13T22:54:56.550865+00:00 ingress-1 haproxy[275]: 35.204.116.138:48808 [13/Oct/2026:22:54:56. ... show more 2026-10-13T22:54:56.550865+00:00 ingress-1 haproxy[275]: 35.204.116.138:48808 [13/Oct/2026:22:54:56.550] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 60/60/0/0/0 0/0 "GET https://vault.mentis.si/manage HTTP/2.0" 2026-10-13T22:54:56.552241+00:00 ingress-1 haproxy[275]: 35.204.116.138:48808 [13/Oct/2026:22:54:56.551] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 60/60/0/0/0 0/0 "GET https://vault.mentis.si/auth/login HTTP/2.0" 2026-10-13T22:54:56.553002+00:00 ingress-1 haproxy[275]: 35.204.116.138:48808 [13/Oct/2026:22:54:56.552] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 60/60/0/0/0 0/0 "GET https://vault.mentis.si/signin HTTP/2.0" 2026-10-13T22:54:56.553083+00:00 ingress-1 haproxy[275]: 35.204.116.138:48808 [13/Oct/2026:22:54:56.552] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 60/60/0/0/0 0/0 "GET https://vault.mentis.si/sign-in HTTP/2.0" 2026-10-13T22:54:56.553304+00:00 ingress-1 haproxy[275]: 35.204.116.138:48808 [13/Oct/2026:22:54:56 ... show less	DDoS Attack
Anonymous	2026-10-13 22:35:22 (5 days ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇳🇱 homeshowdomain.nl	2026-10-13 21:59:18 (5 days ago)	Auto-ban: >3000 req/min op 2026-10-13	Web App Attack SSH Hacking
🇳🇱 e.fierstra	2026-10-13 21:30:48 (5 days ago)	excessive HTTP 404 errors	Bad Web Bot
🇩🇪 snhosting	2026-10-13 19:05:21 (5 days ago)	35.204.116.138 - - [13/Oct/2026:21:05:10 +0200] "POST /read-document HTTP/2.0" 403 543 "-" "Mozilla/ ... show more 35.204.116.138 - - [13/Oct/2026:21:05:10 +0200] "POST /read-document HTTP/2.0" 403 543 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 35.204.116.138 - - [13/Oct/2026:21:05:11 +0200] "POST /graphql HTTP/2.0" 403 554 "https://docs.snsolution.de" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0" 35.204.116.138 - - [13/Oct/2026:21:05:11 +0200] "GET /.gitlab-ci.yml HTTP/2.0" 302 0 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected]) AppleWebKit/537.36" 35.204.116.138 - - [13/Oct/2026:21:05:11 +0200] "GET /.github/workflows/deploy.yml HTTP/2.0" 302 0 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" 35.204.116.138 - - [13/Oct/2026:21:05:11 +0200] "GET /.env.supabase HTTP/2.0" 302 0 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)" ... show less	DNS Compromise DNS Poisoning Phishing Email Spam Brute-Force Web App Attack SSH

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.79

🇮🇳 160.191.28.10

🇩🇪 109.160.32.145

🇺🇸 107.175.109.27

🇵🇱 104.165.20.255

🇱🇹 77.90.185.78

🇺🇸 47.77.219.94

🇩🇪 45.86.202.83

🇨🇳 112.38.50.125

🇩🇪 109.160.32.134

🇭🇰 101.36.125.2

🇲🇦 41.92.118.204

🇧🇪 34.78.157.123

🇯🇵 8.209.254.177

🇷🇴 2.57.121.112

🇷🇴 2.57.121.25

🇰🇬 212.112.126.226

🇷🇺 178.49.87.211

🇪🇸 81.172.90.76

🇷🇴 80.94.92.65