JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.221.87.52

35.221.87.52 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	52.87.221.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.221.87.52

Whois 35.221.87.52

IP Abuse Reports for 35.221.87.52:

This IP address has been reported a total of 28 times from 23 distinct sources. 35.221.87.52 was first reported on October 14th 2026, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 🇨🇭 Hosting	2026-10-16 05:10:28 (17 hours ago)	Automated WAF report: 200-300 blocked requests from this IP detected by our WAF.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-15 11:20:00 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:19:52.657593 2026] [security2:error] [pid 28718:tid 28718] [client 35.221.87.52:47072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dixiegeek.cosentient.com"] [uri "/.git/config"] [unique_id "atC22N5aOsMk-DYIPoldIwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FD-IX	2026-10-15 08:52:25 (1 day ago)	Fail2Ban: ModSecurity detected a web application attack.	Bad Web Bot Web App Attack
Anonymous	2026-10-15 08:45:04 (1 day ago)	Bot / scanning and/or hacking attempts: GET /.env.backup1 HTTP/1.1, GET /vite/.env HTTP/1.1, GET /tm ... show more Bot / scanning and/or hacking attempts: GET /.env.backup1 HTTP/1.1, GET /vite/.env HTTP/1.1, GET /tmp/.env HTTP/1.1, GET /lab/.env HTTP/1.1, GET /cache/.env HTTP/1.1, GET /logs/.env HTTP/1.1, GET /cron/.env HTTP/1.1, GET /cronlab/.env HTTP/1.1, GET /.env.backup2 HTTP/1.1, GET /administrator/.env HTTP/1.1, GET /psnlink/.env HTTP/1.1, GET /sitemaps/.env HTTP/1.1, GET /exapi/.env HTTP/1.1, GET /temp/.env HTTP/1.1, GET /en/.env HTTP/1.1 show less	Hacking Web App Attack
🇩🇪 4server	2026-10-15 08:09:51 (1 day ago)	[ThuOct1510:09:47.3744182026][security2:error][pid3693029:tid3693077][client35.221.87.52:0]ModSecuri ... show more [ThuOct1510:09:47.3744182026][security2:error][pid3693029:tid3693077][client35.221.87.52:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.distributori-automatici-sigarette-ticino.ch.136-243-54-122.cpanel.site\"][uri\"/phpinfo.php.bak\"][unique_id\"atCKS3fv7G8WQzMQj1msEAAAAIs\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 maxxsense	2026-10-15 07:02:33 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 35.221.87.52 (JP/Japan/52.87.221.35.bc. ... show more (mod_security) mod_security triggered on hostname [redacted] 35.221.87.52 (JP/Japan/52.87.221.35.bc.googleusercontent.com) show less	SQL Injection
🇺🇸 TPI-Abuse	2026-10-15 06:49:27 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 02:49:20.264009 2026] [security2:error] [pid 26814:tid 26814] [client 35.221.87.52:42820] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.disneyweddinginvitations.com"] [uri "/.git/config"] [unique_id "atB3cB5uzjasMOlmkhn1NAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 agenciahypelab.com.br	2026-10-15 06:25:44 (1 day ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-10-15 06:02:01 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 02:01:53.248315 2026] [security2:error] [pid 2350:tid 2350] [client 35.221.87.52:47370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.disenowebprofesional.com.spyasociados.com"] [uri "/.git/config"] [unique_id "atBsUZ0WEUBD1a-8beKhbQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-10-15 06:00:49 (1 day ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇬🇧 Aetherweb Ark	2026-10-15 05:47:01 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 35.221.87.52 (JP/Japan/52.87.221.35.bc.googleus ... show more (mod_security) mod_security (id:949110) triggered by 35.221.87.52 (JP/Japan/52.87.221.35.bc.googleusercontent.com): N in the last X secs show less	Web App Attack
🇬🇧 consul.to	2026-10-15 05:31:04 (1 day ago)	Web attack/malicious scanning detected	Web App Attack
🇳🇱 Site.eu	2026-10-15 01:44:16 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 ConsulHosting	2026-10-15 01:40:43 (1 day ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇺🇸 TPI-Abuse	2026-10-15 00:56:43 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent ... show more (mod_security) mod_security (id:210492) triggered by 35.221.87.52 (52.87.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 20:56:36.902880 2026] [security2:error] [pid 9878:tid 9878] [client 35.221.87.52:60884] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dinogirl.com"] [uri "/.git/config"] [unique_id "atAkxMeDCm85B9nl4DqxPwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 221.226.114.202

🇲🇾 165.154.147.69

🇬🇧 161.35.40.182

🇬🇧 134.209.23.215

🇬🇧 104.248.170.254

🇬🇧 46.101.84.163

🇹🇷 45.87.120.43

🇯🇵 34.146.42.222

🇬🇧 206.189.120.152

🇷🇺 176.32.155.227

🇺🇸 162.141.123.71

🇬🇧 144.126.198.105

🇨🇳 121.229.156.94

🇧🇩 103.159.2.113

🇰🇷 61.37.150.6

🇦🇷 45.229.30.199

🇳🇱 45.148.10.141

🇧🇪 34.34.163.51

🇺🇸 20.171.13.13

🇬🇧 206.189.21.43