JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.228.130.189

35.228.130.189 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	189.130.228.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇫🇮 Finland
City	Lappeenranta, South Karelia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.228.130.189

Whois 35.228.130.189

IP Abuse Reports for 35.228.130.189:

This IP address has been reported a total of 38 times from 24 distinct sources. 35.228.130.189 was first reported on August 31st 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-01 13:51:43 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:51:39.565728 2026] [security2:error] [pid 20905:tid 20905] [client 35.228.130.189:43322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.anchorroots.com"] [uri "/.env.backup"] [unique_id "apbYa4JJ2kvnUorkY4fAeAAAACc"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 zynex	2026-09-01 13:08:49 (7 hours ago)	URL Probing: /wp-config.php.bak	Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 12:39:12 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:39:07.755381 2026] [security2:error] [pid 19156:tid 19156] [client 35.228.130.189:44452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chrisrest.com"] [uri "/wp-config.php.bak"] [unique_id "apbHazDzeTJgRQL45O461AAAACQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 11:55:55 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:55:48.541309 2026] [security2:error] [pid 19770:tid 19770] [client 35.228.130.189:39004] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "destintoday.com"] [uri "/.env.bak"] [unique_id "apa9REWHS5weY3hM8up5_gAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 11:01:27 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 07:01:23.728063 2026] [security2:error] [pid 7631:tid 7631] [client 35.228.130.189:38654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.crearetest.com"] [uri "/.env.local"] [unique_id "apawgwTb_2Ha97drINRc-AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-01 10:04:46 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercon ... show more (mod_security) mod_security (id:210492) triggered by 35.228.130.189 (189.130.228.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:04:39.148804 2026] [security2:error] [pid 15822:tid 15822] [client 35.228.130.189:50422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "truecontrarian.royal-barbershop.com"] [uri "/.env.save"] [unique_id "apajN3jsMR-uy1iisBf5OgAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 MM-bot	2026-09-01 10:00:07 (11 hours ago)	URL-probe: HTTP/1.1 GET request on /actuator/env (2026-09-01 12:00:07 UTC+2)	Web App Attack Hacking
🇫🇷 masterguru	2026-09-01 09:41:01 (11 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.228.130.189 (FI/Finland/189.130.22 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.228.130.189 (FI/Finland/189.130.228.35.bc.googleusercontent.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇨🇦 Bots.go.to.hell	2026-09-01 09:39:13 (11 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇦🇺 aranguren.org	2026-09-01 09:34:41 (11 hours ago)	35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /.env HTTP/1.1" 404 995 "-" "crusader-worker/1. ... show more 35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /.env HTTP/1.1" 404 995 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /.env.save HTTP/1.1" 404 995 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /.env.prod HTTP/1.1" 404 995 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /env HTTP/1.1" 404 995 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /storage/logs/laravel.log HTTP/1.1" 404 995 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:19:34:40 +1000] "GET /wp-config.php.bak HTTP/1.1" 404 995 "-" "crusader-worker/1.0" ... show less	Bad Web Bot
🇳🇱 WeCloudit-Anti-Abuse	2026-09-01 08:35:14 (12 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
Anonymous	2026-09-01 08:35:10 (12 hours ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot
Anonymous	2026-09-01 07:49:48 (13 hours ago)	Auto-reported by Fail2Ban (NPM-Auth)	Web App Attack
🇩🇪 FeG Deutschland	2026-09-01 07:47:58 (13 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
Anonymous	2026-09-01 07:40:02 (13 hours ago)	(config_exploit_scan) Configuratie Scanner / Nep GPTBot 35.228.130.189 (FI/Finland/189.130.228.35.bc ... show more (config_exploit_scan) Configuratie Scanner / Nep GPTBot 35.228.130.189 (FI/Finland/189.130.228.35.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 35.228.130.189 - - [01/Sep/2026:09:40:01 +0200] "GET /.env.save HTTP/1.1" 406 4830 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:09:40:01 +0200] "GET /.env.old HTTP/1.1" 406 4830 "-" "crusader-worker/1.0" 35.228.130.189 - - [01/Sep/2026:09:40:01 +0200] "GET /.env.backup HTTP/1.1" 406 4831 "-" "crusader-worker/1.0" show less	Port Scan

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 213.177.179.151

🇺🇸 158.94.187.249

🇺🇸 98.174.61.78

🇫🇷 91.231.89.205

🇲🇲 37.111.53.110

🇺🇸 35.167.90.183

🇫🇮 34.88.29.206

🇨🇳 223.243.179.70

🇳🇱 195.178.110.26

🇨🇴 190.5.200.98

🇺🇸 170.130.163.197

🇳🇱 160.119.66.50

🇬🇧 31.14.254.45

🇨🇱 200.86.65.233

🇳🇱 192.253.248.229

🇺🇸 191.102.178.168

🇨🇴 129.222.203.21

🇳🇱 128.199.42.104

🇭🇰 103.30.40.129

🇺🇸 97.107.129.244