JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.204.248.49

35.204.248.49 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	49.248.204.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇳🇱 Netherlands
City	Groningen, Groningen

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.204.248.49

Whois 35.204.248.49

IP Abuse Reports for 35.204.248.49:

This IP address has been reported a total of 32 times from 23 distinct sources. 35.204.248.49 was first reported on October 15th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2026-10-16 16:19:24 (2 hours ago)	Repeated exploit attempts, for example: /.env.local /.env (HTTP/1.1 port 443, user agent: "Mozilla/5 ... show more Repeated exploit attempts, for example: /.env.local /.env (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36") show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-16 16:11:22 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 12:11:15.228011 2026] [security2:error] [pid 7361:tid 7361] [client 35.204.248.49:45070] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.join.oxfordgliding.com"] [uri "/.git/config"] [unique_id "atJMo7WjqaItihx8rvsMuQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-16 14:26:22 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 10:26:16.192128 2026] [security2:error] [pid 383:tid 383] [client 35.204.248.49:56338] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.johnson.thenewplace.org"] [uri "/.git/config"] [unique_id "atI0CNi_XHl0ZZEGtYD_iQAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-10-16 12:58:15 (5 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 35.204.248.49 (49.248.204.35.bc.googleu ... show more (mod_security) mod_security triggered on hostname [redacted] 35.204.248.49 (49.248.204.35.bc.googleusercontent.com) show less	SQL Injection
🇺🇸 TPI-Abuse	2026-10-16 12:39:09 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 08:39:06.174689 2026] [security2:error] [pid 25262:tid 25262] [client 35.204.248.49:55474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.johnlittlehorn.littlehorndesign.com"] [uri "/.git/config"] [unique_id "atIa6lufYyjpMQQGufFslQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 johnkarlhill	2026-10-16 12:26:17 (6 hours ago)	WebKnight blocked malicious web request on johnkarlhill.com	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-10-16 12:08:40 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 08:08:36.106441 2026] [security2:error] [pid 351:tid 351] [client 35.204.248.49:49156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.johnhansonmemorial.org.coolingsprings.org"] [uri "/.git/config"] [unique_id "atITxEnan9BhwuC6c6D3ygAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-16 11:46:18 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 07:46:13.777853 2026] [security2:error] [pid 1020:tid 1020] [client 35.204.248.49:56934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.johnedwardsconsulting.com.danged.com"] [uri "/.git/config"] [unique_id "atIOhUqf6-GAmcpQ5WN9hwAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-10-16 11:37:00 (7 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇬🇧 Aetherweb Ark	2026-10-16 11:28:48 (7 hours ago)	(mod_security) mod_security (id:949110) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:949110) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): N in the last X secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-16 11:08:01 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.204.248.49 (49.248.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 07:07:58.249352 2026] [security2:error] [pid 22600:tid 22600] [client 35.204.248.49:47206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.johnbentley.modelengines.info"] [uri "/.git/config"] [unique_id "atIFjlpN0qg4RCFkE6RhhgAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-10-16 10:25:02 (8 hours ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-10-16 10:20:10 (8 hours ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇨🇭 zynex	2026-10-16 10:08:10 (8 hours ago)	URL Probing: /.env	Web App Attack
🇩🇪 yitzhaq	2026-10-16 10:06:27 (8 hours ago)	35.204.248.49 - - [16/Oct/2026:12:06:23 +0200] "GET /.env.save HTTP/1.1" 404 519 "-" "Mozilla/5.0 (W ... show more 35.204.248.49 - - [16/Oct/2026:12:06:23 +0200] "GET /.env.save HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.204.248.49 - - [16/Oct/2026:12:06:23 +0200] "GET /.env.old HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.204.248.49 - - [16/Oct/2026:12:06:23 +0200] "GET /.env.sample HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.204.248.49 - - [16/Oct/2026:12:06:23 +0200] "GET /.env.example HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35.204.248.49 - - [16/Oct/2026:12:06:23 +0200] "GET /.env.dev HTTP/1.1" 404 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 35 show less	Bad Web Bot

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 189.196.23.10

🇨🇳 120.48.176.103

🇨🇳 118.145.237.236

🇰🇿 89.218.69.66

🇷🇺 86.102.111.211

🇳🇱 81.19.216.108

🇺🇸 66.132.186.179

🇲🇾 47.250.38.192

🇺🇸 206.189.225.181

🇧🇷 205.210.31.240

🇩🇪 167.94.146.44

🇳🇱 109.160.32.49

🇺🇸 107.0.200.227

🇬🇧 92.27.101.99

🇩🇪 91.92.43.221

🇨🇦 85.217.149.62

🇰🇷 20.196.193.222

🇨🇳 14.103.118.153

🇨🇳 218.94.4.146

🇺🇸 205.210.31.36