3.148.188.76

Automatically blocked after 2 security events. Observed sensitive configuration-file probes. Source: Cloudflare security controls.

malicious scanning tool activity

Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /appsettings.json | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot • Generated ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /appsettings.json | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less

(c5_sensitive_scan) Custom5 Sensitive File Exploit Blocked 3.148.188.76 (US/United States/ec2-3-148-188-76.us-east-2.compute.amazonaws.com): 1 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: default:80 3.148.188.76 ... show more (c5_sensitive_scan) Custom5 Sensitive File Exploit Blocked 3.148.188.76 (US/United States/ec2-3-148-188-76.us-east-2.compute.amazonaws.com): 1 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: default:80 3.148.188.76 - - [28/Aug/2026:18:51:46 +0300] "GET /auth.json HTTP/1.1" 404 409 "-" "Mozilla/5.0 (compatible; Diffbot/1.0; +https://diffbot.com)" show less

15 attempts against mh-modsecurity-ban on byrd

[Drupal AbuseIPDB module] Request path is blacklisted. /wp-json

Portscan: TCP/8443 (9x), TCP/8080 (9x), TCP/443, TCP/80

[redacted] 3.148.188.76 - - [28/Aug/2026:10:05:33 +0100] "GET /.aws/config HTTP/1.1" 302 6778 0/82660 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@[redacted])" [redacted] 3.148.188.76 - - [28/Aug/2026:10:05:34 +0100] "GET /.aws/credentia ... show more [redacted] 3.148.188.76 - - [28/Aug/2026:10:05:33 +0100] "GET /.aws/config HTTP/1.1" 302 6778 0/82660 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@[redacted])" [redacted] 3.148.188.76 - - [28/Aug/2026:10:05:34 +0100] "GET /.aws/credentials HTTP/1.1" 302 6778 0/48560 "-" "Mozilla/5.0 (compatible; Bytespider; spider-feedback@[redacted])" show less

[DOT FILES] crawler *.env*, .git*, .config*, etc.

(mod_security) mod_security (id:210730) triggered by 3.148.188.76 (ec2-3-148-188-76.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 03:30:53.583148 2026] [security2:error] [pid 1 ... show more (mod_security) mod_security (id:210730) triggered by 3.148.188.76 (ec2-3-148-188-76.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 03:30:53.583148 2026] [security2:error] [pid 10983:tid 10983] [client 3.148.188.76:42138] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ofertasdetrabajosyempleos.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ofertasdetrabajosyempleos.com"] [uri "/rclone.conf"] [unique_id "apE5LQdqTfSAF3x1TR4q4AAAAAM"] show less

3.148.188.76 - - [27/Aug/2026:23:44:53 -0400] "GET /.aws/credentials HTTP/1.1" 403 6302 "https://www.stwinifredsschool.com/.aws/credentials" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/pe ... show more 3.148.188.76 - - [27/Aug/2026:23:44:53 -0400] "GET /.aws/credentials HTTP/1.1" 403 6302 "https://www.stwinifredsschool.com/.aws/credentials" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" ... show less

Bot / scanning and/or hacking attempts: [30/30] read: stream 0, , GET /console HTTP/2.0, GET /register HTTP/2.0, GET /app HTTP/2.0, GET /.env.example HTTP/2.0, GET /portal HTTP/2.0, GET /auth/login HTTP/2.0, [19/19] read: stream 0, , GET /users/log ... show more Bot / scanning and/or hacking attempts: [30/30] read: stream 0, , GET /console HTTP/2.0, GET /register HTTP/2.0, GET /app HTTP/2.0, GET /.env.example HTTP/2.0, GET /portal HTTP/2.0, GET /auth/login HTTP/2.0, [19/19] read: stream 0, , GET /users/login HTTP/2.0, GET /secure HTTP/2.0 show less

CrowdSec ban for AbuseIPDB Top List

HTTP vulnerability scanning

3.148.188.76 - - [28/Aug/2026:02:17:33 +0200] "GET /.git/config HTTP/2.0" 403 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot" ...