JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 35.252.254.116

35.252.254.116 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 100%: ?

100%

ISP	Google LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS396982
Hostname(s)	116.254.252.35.bc.googleusercontent.com
Domain Name	google.com
Country	🇺🇸 United States of America
City	The Dalles, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 35.252.254.116

Whois 35.252.254.116

IP Abuse Reports for 35.252.254.116:

This IP address has been reported a total of 23 times from 22 distinct sources. 35.252.254.116 was first reported on August 24th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-08-25 04:16:33 (5 hours ago)	Wordpress malicious attack:[octamissingdomain]	Web App Attack
🇧🇷 SOC Blue Team	2026-08-24 17:26:04 (16 hours ago)	IPs get by Hunting on SIEM	Phishing Web Spam Port Scan Hacking
🇳🇿 Antinson	2026-08-24 14:16:54 (19 hours ago)	Scraping with a high error ratio and request rate	Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-24 13:45:12 (20 hours ago)	(mod_security) mod_security (id:225170) triggered by 35.252.254.116 (116.254.252.35.bc.googleusercon ... show more (mod_security) mod_security (id:225170) triggered by 35.252.254.116 (116.254.252.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 09:45:06.207371 2026] [security2:error] [pid 32125:tid 32125] [client 35.252.254.116:51807] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|bamedica.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bamedica.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aoxK4ldv54qwEm5RxeEk-gAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 todix	2026-08-24 13:43:08 (20 hours ago)	Web App Attack Exploid from 35.252.254.116	Web App Attack
🇳🇱 ipoac.nl	2026-08-24 13:40:33 (20 hours ago)	-:443 35.252.254.116 - - [24/Aug/2026:15:40:32 +0200] - "GET //xmlrpc.php?rsd HTTP/1.1" 403 1072 "-" ... show more -:443 35.252.254.116 - - [24/Aug/2026:15:40:32 +0200] - "GET //xmlrpc.php?rsd HTTP/1.1" 403 1072 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" show less	Bad Web Bot
🇵🇱 Budyn	2026-08-24 13:38:29 (20 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: backup.teddypot.cloud \| URI: //xmlrpc.php?rsd \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
Anonymous	2026-08-24 13:28:53 (20 hours ago)	Fail2Ban triggered	Web App Attack
🇷🇴 clauss	2026-08-24 13:27:03 (20 hours ago)	35.252.254.116 - - [24/Aug/2026:16:27:00 +0300] "GET //blog/wp-includes/wlwmanifest.xml HTTP/2.0" 20 ... show more 35.252.254.116 - - [24/Aug/2026:16:27:00 +0300] "GET //blog/wp-includes/wlwmanifest.xml HTTP/2.0" 200 390 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 35.252.254.116 - - [24/Aug/2026:16:27:00 +0300] "GET //web/wp-includes/wlwmanifest.xml HTTP/2.0" 200 390 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 35.252.254.116 - - [24/Aug/2026:16:27:01 +0300] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/2.0" 200 390 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 35.252.254.116 - - [24/Aug/2026:16:27:01 +0300] "GET //wp/wp-includes/wlwmanifest.xml HTTP/2.0" 200 390 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 35.252.254.116 - - [24/Aug/2026:16:27:01 +0300] "GET //2020/wp-includes/wlwmanifest.xml HT ... show less	Web App Attack
🇨🇦 TechnoSolutions CL	2026-08-24 13:21:36 (20 hours ago)	35.252.254.116 - - [24/Aug/2026:13:21:36 +0000] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 40 ... show more 35.252.254.116 - - [24/Aug/2026:13:21:36 +0000] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 400 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" 35.252.254.116 - - [24/Aug/2026:13:21:36 +0000] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 400 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" ... show less	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-24 13:20:12 (20 hours ago)	35.252.254.116 - - [24/Aug/2026:21:20:11 +0800] "GET //xmlrpc.php?rsd HTTP/1.1" 200 30693 "-" "Mozil ... show more 35.252.254.116 - - [24/Aug/2026:21:20:11 +0800] "GET //xmlrpc.php?rsd HTTP/1.1" 200 30693 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-08-24 13:20:09 (20 hours ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇨🇭 Origon	2026-08-24 13:18:03 (20 hours ago)	http-probing - IP: 35.252.254.116 - time="2026-08-24T15:18:02+02:00" level=info msg="(555f66b4f6a74 ... show more http-probing - IP: 35.252.254.116 - time="2026-08-24T15:18:02+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 35.252.254.116 (US/396982) : 4h ban on Ip 35.252.254.116" module=db show less	Web App Attack
🇨🇭 backslash	2026-08-24 13:18:00 (20 hours ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇬🇧 gigatech	2026-08-24 13:15:03 (20 hours ago)	Webserver Probing	Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 121.168.164.245

🇺🇸 104.164.126.116

🇧🇷 93.157.108.169

🇱🇹 213.176.26.165

🇱🇹 213.176.26.113

🇺🇸 206.232.122.49

🇺🇸 192.243.104.23

🇲🇽 189.189.32.11

🇳🇱 185.223.235.8

🇦🇷 181.13.242.183

🇺🇸 165.154.172.87

🇸🇬 152.42.247.218

🇱🇰 112.134.243.133

🇪🇸 104.250.214.57

🇮🇳 103.53.39.58

🇺🇸 44.220.188.183

🇳🇬 2c0f:f5c0:600:93d5:700d:223e:975e:3bc7

🇰🇷 222.97.67.147

🇺🇸 216.25.89.120

🇱🇹 213.176.26.82