Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated scanning of a public web platform for credential and configuration files and for file-read endpoints: requests for .env variants, .aws/credentials, .git/config, proc/self/environ and several API file-view and file-read paths.
Automated sensitive-file/web application probing observed from 2026-11-06T18:55:14+00:00 to 2026-11-06T20:00:14+00:00 UTC: 175 strong probe-indicator requests across 161 distinct normalized paths. HTTP success does not prove sensitive-file access or ...
show moreAutomated sensitive-file/web application probing observed from 2026-11-06T18:55:14+00:00 to 2026-11-06T20:00:14+00:00 UTC: 175 strong probe-indicator requests across 161 distinct normalized paths. HTTP success does not prove sensitive-file access or authentication. Response contents not verified; no compromise established. Evidence a1584deac5007b3c1cf3a0825f00dd7c5244135b92702d500bd26629408ffcf1.
show less
Web App Attack
Anonymous
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
Anonymous
(mod_security) mod_security triggered on hostname [redacted] 34.180.92.173 (JP/Japan/173.92.180.34.bc.googleusercontent.com)
Insights: web vulnerability probing, 57 requests on 1 site, e.g. /public/.env, /dist../.env, /logs/.env (rotating 29 fake bot names, e.g. Kimi-SearchBot, Browser via Google Cloud, Baiduspide
{"level":"info","ts":1793981065.0139456,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.180.92.173","remote_port":"40942","client_ip":"34.180.92.173","proto":"HTTP/2.0","method":"GET","host":"status.labman.io","uri" ...
show more{"level":"info","ts":1793981065.0139456,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.180.92.173","remote_port":"40942","client_ip":"34.180.92.173","proto":"HTTP/2.0","method":"GET","host":"status.labman.io","uri":"/.env.preprod","headers":{"X-Real-Ip":["100.76.167.96"],"X-Forwarded-For":["100.76.167.96"],"X-Proxyuser-Ip":["100.76.167.96"],"X-Nextjs-Data":["1"],"X-Originating-Ip":["100.76.167.96"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Accept-Encoding":["gzip"],"X-Client-Ip":["100.76.167.96"],"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot"],"X-Remote-Addr":["100.76.167.96"],"Cookie":["REDACTED"],"X-Custom-Ip-Authorization":["100.76.167.96"],"Forwarded":["for=100.76.167.96"],"X-Remote-Ip":["100.76.167.96"],"True-Client-Ip":["100.76
...
show less
