JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.247.203.28

35.247.203.28 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 96%: ?

96%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	28.203.247.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.247.203.28

Whois 35.247.203.28

IP Abuse Reports for 35.247.203.28:

This IP address has been reported a total of 26 times from 21 distinct sources. 35.247.203.28 was first reported on September 4th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-16 22:02:06 (1 day ago)	Auto-ban: >3000 req/min op 2026-09-16	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-09-16 06:49:03 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 35.247.203.28 (28.203.247.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.247.203.28 (28.203.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 02:48:59.094096 2026] [security2:error] [pid 622:tid 622] [client 35.247.203.28:41694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.staff.getitenglish.com"] [uri "/.git/config"] [unique_id "aqo72-K6XF1FC2PnGueUEAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-09-16 04:47:51 (1 day ago)	Multiple WAF Violations	Web App Attack
🇳🇱 Alt255	2026-09-16 02:36:57 (1 day ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35. ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 35.247.203.28 - - \[16/Sep/2026:04:36:52 +0200\] "GET /.git/config HTTP/1.1" 500 6015 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇳🇴 jad-abuse	2026-09-16 02:33:31 (1 day ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_expos ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, env_probe, source_backup. Observed by 1 sensor(s); 17 hits. show less	Web App Attack
🇮🇩 Burayot	2026-09-15 21:48:04 (2 days ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 35.247.203.28 (BR/Brazil/28.203.247. ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 35.247.203.28 (BR/Brazil/28.203.247.35.bc.googleusercontent.com): 2 in the last 3600 secs show less	Web App Attack
🇪🇸 robotstxt	2026-09-15 19:49:34 (2 days ago)	35.247.203.28 - - [15/Sep/2026:19:48:32 +0000] "POST / HTTP/1.1" 403 18465 "-" "Mozilla/5.0 (X11; Li ... show more 35.247.203.28 - - [15/Sep/2026:19:48:32 +0000] "POST / HTTP/1.1" 403 18465 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="35.247.203.28" 35.247.203.28 - - [15/Sep/2026:19:48:33 +0000] "POST / HTTP/1.1" 403 18466 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="35.247.203.28" 35.247.203.28 - - [15/Sep/2026:19:48:33 +0000] "GET /.git/config HTTP/1.1" 403 14325 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="35.247.203.28" 35.247.203.28 - - [15/Sep/2026:19:48:33 +0000] "GET /.env HTTP/1.1" 403 14325 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="35.247.203.28" 35.247.203.28 - - [15/Sep/2026:19:48:34 +0000] "GET /.env.local HTTP/1.1" 403 14325 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge ... show less	Web App Attack
🇳🇱 Mangelot Hosting	2026-09-15 19:27:42 (2 days ago)	(modsecurity) srv102 ModSecurity 35.247.203.28 (BR/Brazil/28.203.247.35.bc.googleusercontent.com): 3 ... show more (modsecurity) srv102 ModSecurity 35.247.203.28 (BR/Brazil/28.203.247.35.bc.googleusercontent.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇳🇱 debestelapp	2026-09-15 09:10:11 (2 days ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-09-15 07:18:49 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 35.247.203.28 (28.203.247.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.247.203.28 (28.203.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 03:18:43.002662 2026] [security2:error] [pid 18240:tid 18240] [client 35.247.203.28:39282] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.justiniggercom.indie100.com"] [uri "/.git/config"] [unique_id "aqjxU56tiveudbkZcLJVPgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-09-15 04:22:35 (2 days ago)	Excessive multi-domain requests	Brute-Force
🇳🇱 homeshowdomain.nl	2026-09-05 22:03:17 (1 week ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-04. show less	Web App Attack SSH Hacking
🇳🇱 e.fierstra	2026-09-04 15:01:24 (1 week ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-04 14:47:22 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 35.247.203.28 (28.203.247.35.bc.googleuserconte ... show more (mod_security) mod_security (id:210492) triggered by 35.247.203.28 (28.203.247.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 10:47:15.627025 2026] [security2:error] [pid 31768:tid 31768] [client 35.247.203.28:58140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "claytonappliancenewnan.com"] [uri "/.env.dev"] [unique_id "aprZ87OPaCADVYcwlujQsgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-09-04 13:40:04 (1 week ago)	crowdsecurity/http-sensitive-files	Brute-Force Web App Attack

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 217.60.255.130

🇻🇳 115.79.112.8

🇰🇷 106.251.50.73

🇺🇸 104.143.77.9

🇷🇴 77.81.21.130

🇺🇸 73.56.14.107

🇺🇸 20.163.34.119

🇩🇪 213.209.159.236

🇧🇷 205.164.249.176

🇧🇪 198.235.24.169

🇻🇳 171.231.182.149

🇩🇪 159.195.67.193

🇺🇸 147.185.132.139

🇺🇸 147.185.132.12

🇨🇳 124.174.14.174

🇧🇩 103.86.198.253

🇧🇩 103.60.204.198

🇧🇬 79.124.58.18

🇺🇸 45.56.83.247

🇮🇩 41.216.178.119