JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.220.149.2

35.220.149.2 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 89%: ?

89%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	2.149.220.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.220.149.2

Whois 35.220.149.2

IP Abuse Reports for 35.220.149.2:

This IP address has been reported a total of 22 times from 17 distinct sources. 35.220.149.2 was first reported on July 4th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-08-01 21:59:08 (2 hours ago)	Auto-ban: >3000 req/min op 2026-08-01	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-08-01 17:11:05 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 13:10:56.865091 2026] [security2:error] [pid 5040:tid 5040] [client 35.220.149.2:55804] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "economy-cleaners.walkerweb.com"] [uri "/.env.dev"] [unique_id "am4ooNGYKDI2tN05UbKUJQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-01 17:00:04 (7 hours ago)	suspicious request in access.log	Web App Attack
🇵🇫 www.gregorymariani.com	2026-08-01 16:10:31 (8 hours ago)	35.220.149.2 - - [01/Aug/2026:16:10:30 +0000] "GET /.env HTTP/1.1" 404 4036 "-" "crusader-worker/1.0 ... show more 35.220.149.2 - - [01/Aug/2026:16:10:30 +0000] "GET /.env HTTP/1.1" 404 4036 "-" "crusader-worker/1.0" 399 0.010 [default-techdata-service-80] [] 10.244.7.82:3000 4036 0.010 404 97e46fb2eb59919734ae8da5d669b9df 35.220.149.2 - - [01/Aug/2026:16:10:30 +0000] "GET /.env.prod HTTP/1.1" 404 4036 "-" "crusader-worker/1.0" 404 0.017 [default-techdata-service-80] [] 10.244.7.82:3000 4036 0.017 404 6369d7f61403244df77232816acfd8b8 35.220.149.2 - - [01/Aug/2026:16:10:30 +0000] "GET /.env.backup HTTP/1.1" 404 4036 "-" "crusader-worker/1.0" 406 0.033 [default-techdata-service-80] [] 10.244.7.82:3000 4036 0.033 404 b049536ee635fbba92c7b90abb44e595 35.220.149.2 - - [01/Aug/2026:16:10:30 +0000] "GET /.env.local HTTP/1.1" 404 4036 "-" "crusader-worker/1.0" 405 0.024 [default-techdata-service-80] [] 10.244.7.82:3000 4036 0.024 404 060803a6605870fed40baadcb8cfce86 35.220.149.2 - - [01/Aug/2026:16:10:30 +0000] "GET /.env.save HTTP/1.1" 404 4038 "-" "crusader-worker/1.0" 404 0.031 [default-techdata-service ... show less	Web App Attack
🇲🇾 Rizzy	2026-08-01 16:01:40 (8 hours ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇫🇷 COMAITE	2026-08-01 15:52:12 (8 hours ago)	Suspicious URL access.	Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 15:44:48 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 11:44:42.485637 2026] [security2:error] [pid 576197:tid 576197] [client 35.220.149.2:52218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.styxtake2.grayhost.net"] [uri "/.env.example"] [unique_id "am4UalvM_z9kqMfivATu4AAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 billfor	2026-08-01 15:43:31 (8 hours ago)	35.220.149.2 - - [01/Aug/2026:11:43:24 -0400] "GET /.env.production HTTP/1.1" 404 0 "-" "crusader-wo ... show more 35.220.149.2 - - [01/Aug/2026:11:43:24 -0400] "GET /.env.production HTTP/1.1" 404 0 "-" "crusader-worker/1.0" show less	Web App Attack
🇫🇮 23p02732	2026-08-01 15:40:22 (8 hours ago)	Mailserver and mailaccount attacks	Brute-Force Bad Web Bot Exploited Host Web App Attack
🇳🇱 SysAdmin Dylan	2026-08-01 15:11:42 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (HK/Hong Kong/2.149.220.35.bc.goog ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (HK/Hong Kong/2.149.220.35.bc.googleusercontent.com): 10 in the last 3600 secs show less	Brute-Force
🇺🇸 TPI-Abuse	2026-08-01 15:00:06 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 10:59:56.856580 2026] [security2:error] [pid 21993:tid 21993] [client 35.220.149.2:57424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "almudenastrust.com"] [uri "/.env.old"] [unique_id "am4J7BHmAPRTIaHV9JljHwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 14:23:27 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 10:23:21.213565 2026] [security2:error] [pid 519999:tid 520020] [client 35.220.149.2:60418] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fiefseigneur.com.aafm.us"] [uri "/.env.old"] [unique_id "am4BWXzSukvczWW5hLFmRgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-01 13:39:03 (10 hours ago)	Bot / scanning and/or hacking attempts: GET /.env.production HTTP/1.1, GET /.env.bak HTTP/1.1, GET / ... show more Bot / scanning and/or hacking attempts: GET /.env.production HTTP/1.1, GET /.env.bak HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.example HTTP/1.1, GET /.env HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env.save HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.env.old HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 13:33:01 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 09:32:53.991639 2026] [security2:error] [pid 2010731:tid 2010731] [client 35.220.149.2:42796] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "undergroundh2o.com"] [uri "/.env.save"] [unique_id "am31haMzzTMmkZCzcZ__hwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-01 12:21:16 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.220.149.2 (2.149.220.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 01 08:21:09.980404 2026] [security2:error] [pid 23962:tid 23962] [client 35.220.149.2:57626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "themarshalls.tv"] [uri "/.env.production"] [unique_id "am3ktTqlXQHZzV_HLU537QAAACU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇿 219.89.198.191

🇮🇩 203.17.85.108

🇺🇸 195.184.76.68

🇦🇴 193.163.125.169

🇮🇹 172.213.232.128

🇺🇸 159.223.114.192

🇺🇸 146.190.112.200

🇺🇦 109.254.144.38

🇳🇱 89.150.59.242

🇻🇳 58.186.20.101

🇳🇱 45.156.128.131

🇳🇱 45.156.128.45

🇬🇧 35.203.210.196

🇻🇳 27.79.6.83

🇻🇳 27.79.2.54

🇮🇳 14.98.67.210

🇮🇷 213.176.26.182

🇨🇱 200.72.2.190

🇨🇱 179.56.157.141

🇺🇸 162.243.116.182