JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.204.163.54

35.204.163.54 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	54.163.204.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇳🇱 Netherlands
City	Groningen, Groningen

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.204.163.54

Whois 35.204.163.54

IP Abuse Reports for 35.204.163.54:

This IP address has been reported a total of 38 times from 31 distinct sources. 35.204.163.54 was first reported on August 28th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 tjs	2026-09-01 12:33:00 (6 hours ago)	web attack	Hacking Web App Attack
🇳🇱 middelkoopcc	2026-09-01 04:50:05 (14 hours ago)	2026-09-01 06:48:21 GET /static../.env [404] && 2026-09-01 06:48:22 GET /.aws/credentials [404] && 2 ... show more 2026-09-01 06:48:21 GET /static../.env [404] && 2026-09-01 06:48:22 GET /.aws/credentials [404] && 2026-09-01 06:48:22 GET /@fs/etc/passwd?raw?? [404] && 276 more within 20 minutes show less	Web App Attack
🇬🇧 elleray	2026-09-01 04:04:48 (15 hours ago)	Banned by Fail2Ban on apache-auth jail	Brute-Force
🇭🇰 hkphoto.com	2026-09-01 00:39:03 (18 hours ago)	35.204.163.54 - - [01/Sep/2026:08:39:02 +0800] "GET /@fs/proc/self/environ HTTP/1.1" 444 0 "-" "Mozi ... show more 35.204.163.54 - - [01/Sep/2026:08:39:02 +0800] "GET /@fs/proc/self/environ HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot" 35.204.163.54 - - [01/Sep/2026:08:39:02 +0800] "GET /aws/credentials HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.4222.98 Mobile Safari/537.36; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" 35.204.163.54 - - [01/Sep/2026:08:39:02 +0800] "GET /files../etc/passwd HTTP/1.1" 444 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user) Version/16.6 Mobile/15E148 Safari/604.1" 35.204.163.54 - - [01/Sep/2026:08:39:02 +0800] "GET /?file=../../../../etc/passwd HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.2246.174 Saf ... show less	Brute-Force
🇺🇸 thororen	2026-08-31 22:44:47 (20 hours ago)	Blocked by UFW [8443/tcp] Source port: 48144 TTL: 48 Packet length: 60 TOS: 0x00 This report was ge ... show more Blocked by UFW [8443/tcp] Source port: 48144 TTL: 48 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇵🇱 arcy	2026-08-31 20:00:03 (23 hours ago)	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-admin-interface-probing, http-path-traversal-probing, http-probing, http-sensitive-files. 23 matching log events between 2026-08-31T19:59:59Z and 20:00:03Z (UTC). Sample requests: GET /admin/.env -> 404; GET /_profiler/phpinfo -> 404; GET /phpinfo.php -> 404; GET /static../.env -> 404; GET /media../.env -> 404; GET /.aws/credentials -> 404; GET /.git/HEAD -> 404; GET /app/.env -> 404; GET / -> 404; GET /__aws_leak_probe_c34c5dec__ -> 404; GET /.git-credentials -> 404; GET /download?file=../../../../etc/passwd -> 404; GET /?file=../../../../etc/passwd -> 404; GET /proc/self/environ -> 404; GET /read?url=file:///proc/self/environ -> 404; GET /@fs/etc/passwd?import&raw?? -> 404 show less	Port Scan Hacking Web App Attack
🇧🇪 boxed-it	2026-08-31 16:26:51 (1 day ago)	GET /.env (Tarpitted for 56m28s, wasted 198.63kB)	Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 12:48:35 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 35.204.163.54 (54.163.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.163.54 (54.163.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 08:48:26.736184 2026] [security2:error] [pid 20223:tid 20223] [client 35.204.163.54:36340] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.206"] [uri "/static../.env"] [unique_id "apV4Glm_3OSpvEuDipna1QAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 S S	2026-08-31 11:34:35 (1 day ago)	Web vulnerability scanning against ad-serving endpoint: 486 probe requests between 30/Aug/2026:23:52 ... show more Web vulnerability scanning against ad-serving endpoint: 486 probe requests between 30/Aug/2026:23:52:27 +0000 and 30/Aug/2026:23:54:46 +0000 for non-existent sensitive paths (/.env.azure, /.env.bak, /.aws/credentials.bak, /@fs/proc/self/cwd/.aws/credentials, /home/azureuser/.azure/credentials), all returned 404. Detected via nginx ingress access log. show less	Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2026-08-31 11:21:11 (1 day ago)	port=80, indicator_type=info-leak	Hacking
🇧🇾 lns.bz	2026-08-31 11:10:01 (1 day ago)	Too many 404 requests [BY]	Web App Attack
Anonymous	2026-08-31 10:25:16 (1 day ago)	Web Server Enforcement Violation.	Hacking
🇺🇸 MPL	2026-08-31 07:54:33 (1 day ago)	tcp port scan (8 or more attempts)	Port Scan
🇩🇪 F2BP	2026-08-31 04:37:52 (1 day ago)	Honeypot [zap-vps-honeypot]: Empty payload (likely service probe); 9443 [380], 8000 [236], 2375 [1], ... show more Honeypot [zap-vps-honeypot]: Empty payload (likely service probe); 9443 [380], 8000 [236], 2375 [1], 8888 [1], 9000 [1], 9090 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇲🇾 N2N	2026-08-31 04:20:55 (1 day ago)		Hacking Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇳 197.15.228.156

🇬🇧 154.16.44.222

🇦🇺 65.254.92.190

🇮🇳 65.254.81.69

🇺🇸 64.62.197.9

🇳🇱 45.148.10.141

🇮🇳 34.93.114.61

🇰🇷 220.79.230.142

🇩🇪 185.216.213.235

🇨🇱 179.8.158.186

🇹🇷 176.98.41.251

🇫🇷 104.28.243.189

🇵🇱 79.189.129.106

🇺🇸 64.62.197.235

🇦🇿 62.212.230.49

🇹🇼 59.126.47.168

🇮🇳 49.207.241.187

🇸🇰 46.229.233.132

🇱🇹 2a00:809:2b1:3bcd:670d:89ad:2610:c159

🇮🇪 135.236.141.99