This IP address has been reported a total of
152
times from
73 distinct
sources.
34.101.160.150 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 34
reports;
United States of America
with 34
reports;
United Kingdom of Great Britain and Northern Ireland
with 15
reports.
The most common categories in these recent reports were:
Web App Attack
130
times;
Bad Web Bot
66
times;
Brute-Force
47
times;
Hacking
17
times;
Port Scan
6
times;
Other
5
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 1× edge-block in 10 ...
show more[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 1× edge-block in 10m window.
Origin: ID / AS396982 Google LLC
Active: 15:30:07 UTC
Volume: 1 HTTP req
Probed: /.git/config
Status mix: 444×1
UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
Auto-banned 30d. zorvexus-banner.
show less
{"level":"info","ts":1791013593.968838,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more{"level":"info","ts":1791013593.968838,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.101.160.150","remote_port":"41422","client_ip":"34.101.160.150","proto":"HTTP/1.1","method":"GET","host":"status.campr.cloud","uri":"/.env","headers":{"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1"]}},"bytes_read":0,"user_id":"","duration":0.000081025,"size":0,"status":308,"resp_headers":{"Location":["https://status.campr.cloud/.env"],"Content-Type":[],"Server":["Caddy"],"Connection":["close"]}}
{"level":"info","ts":1791013594.933637,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.101.160.150","remote_port":"41426","client_ip":"34.101.160.150","proto":"HTTP/1.1","method":"GET","host":"status.campr.cloud","uri":"/.env.local","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
...
show less
Triggered Cloudflare WAF (linkMaze) from ID.
Action taken: LINK_MAZE_INJECTED
Protocol: HTTP/1.1 (GE ...
show moreTriggered Cloudflare WAF (linkMaze) from ID.
Action taken: LINK_MAZE_INJECTED
Protocol: HTTP/1.1 (GET method)
Endpoint: /.terraform.tfstate
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
AetherGuard WAF blocked: Matched phrase "/sftp-config.json" at REQUEST_URI.
Target: ctf.aetherguard. ...
show moreAetherGuard WAF blocked: Matched phrase "/sftp-config.json" at REQUEST_URI.
Target: ctf.aetherguard.xyz/sftp-config.json
(98 attempts logged from this IP)
Payload / matched WAF rule data:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15
show less
[FriOct0221:42:18.3834452026][security2:error][pid2772927:tid2773018][client34.101.160.150:0]ModSecu ...
show more[FriOct0221:42:18.3834452026][security2:error][pid2772927:tid2773018][client34.101.160.150:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"orabonastudio.it\"][uri\"/.git/config\"][unique_id\"asAJGgRm1fOWU2iVyJFhfQAAAMk\"]
show less
Web probing (1 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CR ...
show moreWeb probing (1 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON.
show less
