This IP address has been reported a total of
55
times from
46 distinct
sources.
35.221.131.175 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
CrowdSec ban: crowdsecurity/http-cve-2021-41773 (e.g. /cache/original/%2e%2e/%2e%2e/.env); first see ...
show moreCrowdSec ban: crowdsecurity/http-cve-2021-41773 (e.g. /cache/original/%2e%2e/%2e%2e/.env); first seen 2026-10-27T04:20:40Z, last seen 2026-10-27T04:20:40Z; reported by WOPR honeypot nedry.wopr.systems
show less
{"level":"info","ts":1793064149.7432432,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1793064149.7432432,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.221.131.175","remote_port":"53166","client_ip":"35.221.131.175","proto":"HTTP/2.0","method":"GET","host":"status.planning.je","uri":"/@fs/.env?url&raw??","headers":{"Accept":["*/*"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.planning.je","ech":false}},"bytes_read":0,"user_id":"","duration":0.000205892,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1793064149.7487164,"logger":"http.log.access.log1","msg":"handled req
...
show less
Automated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanni ...
show moreAutomated fail2ban report from server 176.99.5.35.
Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan).
Observed: 2026-10-27T00:38:42+03:00.
Detections: 1 ban event(s), 5 failed attempts.
Ban duration: 1d.
Sample requests/indicators:
GET /actuator -> 200
GET /.env.preprod -> 200
GET /.env.keys -> 200
GET /.env.production.local -> 200
No personal data included.
--
Reported via Fail2Ban_AbuseIPDB Monitor: https://github.com/paulmann/Fail2Ban_AbuseIPDB
show less
Exploit attempts targeting CVE-2025-55182 (12 requests)
Web vulnerability scanning (432 probes), loo ...
show moreExploit attempts targeting CVE-2025-55182 (12 requests)
Web vulnerability scanning (432 probes), looking for configuration and credential files, path traversal, exposed version control folders, framework debug endpoints, known vulnerable URLs
HTTP flood: 258 requests in a short period
User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile
669 HTTP requests between 2026-10-26 18:35 and 18:46 UTC
show less
Inbound Anomaly Score Exceeded (Total Score: 5). Operator GE matched 5 at TX:anomaly_score. (949110- ...
show moreInbound Anomaly Score Exceeded (Total Score: 5). Operator GE matched 5 at TX:anomaly_score. (949110-122)
show less