This IP address has been reported a total of
16
times from
10 distinct
sources.
34.187.125.233 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 7
reports;
Switzerland
with 2
reports;
Germany
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
14
times;
Brute-Force
9
times;
Bad Web Bot
8
times;
Hacking
6
times;
Port Scan
1
time;
Other
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Auto-ban: 250 malicious requests on 2026-09-24 (e.g., env/backup probes, brute-force, or error burst ...
show moreAuto-ban: 250 malicious requests on 2026-09-24 (e.g., env/backup probes, brute-force, or error bursts).
show less
[ThuSep2408:49:04.3876572026][security2:error][pid3281143:tid3281339][client34.187.125.233:0]ModSecu ...
show more[ThuSep2408:49:04.3876572026][security2:error][pid3281143:tid3281339][client34.187.125.233:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"brunocampagna.com\"][uri\"/.codex/auth.json.old\"][unique_id\"arTH4FENZRFfiIASyDvOowAAAE4\"]
show less
Requested /.codex/auth.json.old, a path with no legitimate use on this server. Tripped an automated ...
show moreRequested /.codex/auth.json.old, a path with no legitimate use on this server. Tripped an automated honeypot.
show less
This address is looking for secret files on our sites: .git directories, .env files, credential and ...
show moreThis address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. | method: GET | path: /app/.claude/credentials.json (+12 more) | 2026-09-23 15:51 UTC
show less
Web application attack / vulnerability scanning against our public nginx web server (TCP 80/443). So ...
show moreWeb application attack / vulnerability scanning against our public nginx web server (TCP 80/443). Source matched a blocked-path security rule (jail nginx-444); server returned HTTP 444 (connection closed without response). TCP three-way handshake completed (full HTTP request received).
show less
Bad Web Bot
Web App Attack
Anonymous
IP matched detection query 20 more in short time bad rqs.
[WedSep2308:35:41.1329802026][security2:error][pid339442:tid339513][client34.187.125.233:0]ModSecuri ...
show more[WedSep2308:35:41.1329802026][security2:error][pid339442:tid339513][client34.187.125.233:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".bak\"][severity\"ERROR\"][hostname\"albafox.ch.81-17-25-250.cpanel.site\"][uri\"/.codex/auth.json.bak\"][unique_id\"arNzPTOZnd3joxouqT81aQAAAMw\"]
show less
[TueSep2211:33:40.2541592026][security2:error][pid3209785:tid3209797][client34.187.125.233:0]ModSecu ...
show more[TueSep2211:33:40.2541592026][security2:error][pid3209785:tid3209797][client34.187.125.233:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".old\"][severity\"ERROR\"][hostname\"swiss-domain-name.aidconsultancy.ch\"][uri\"/.codex/auth.json.old\"][unique_id\"arJLdC36IBDDX-Ry5NGhSQAAAYI\"]
show less
