This IP address has been reported a total of
133
times from
95 distinct
sources.
34.85.197.171 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 33
reports;
Netherlands
with 20
reports;
United States of America
with 18
reports.
The most common categories in these recent reports were:
Web App Attack
98
times;
Brute-Force
40
times;
Bad Web Bot
36
times;
Hacking
28
times;
Port Scan
8
times;
Other
25
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[AI Threat Score: 100/100 via Gemini] [AbuseIPDB Score: 100] The IP address 34.85.197.171 executed 9 ...
show more[AI Threat Score: 100/100 via Gemini] [AbuseIPDB Score: 100] The IP address 34.85.197.171 executed 9 malicious requests targeting sensitive internal files and application paths on majikah.solutions. Activity included probing process environments and command lines via /@fs/proc/self/environ and /@fs/proc/self/cmdline, attempting credential theft via /id_rsa and /id_ed25519, and scanning for configuration secrets via /api-keys alongside traversal attempts on /userfiles and /api/console/api_server. This aggressive reconnaissance is backed by 132 external reports on AbuseIPDB resulting in a 100% confidence score. Likely motive: credential theft and system reconnaissance
show less
{"level":"info","ts":1792478534.4103441,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1792478534.4103441,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.85.197.171","remote_port":"57298","client_ip":"34.85.197.171","proto":"HTTP/2.0","method":"GET","host":"status.app8.eu","uri":"/asset-manifest.json","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Priority":["u=0, i"],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Fetch-User":["?1"],"Sec-Fetch-Dest":["document"],"Upgrade-Insecure-Requests":["1"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Fetch-Mode":["navigate"],"Sec-
...
show less
(mod_security) mod_security (id:930130) triggered by 34.85.197.171 (US/United States/171.197.85.34.b ...
show more(mod_security) mod_security (id:930130) triggered by 34.85.197.171 (US/United States/171.197.85.34.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
show less
Multiple web server 400 error codes from same source ip. (1,808 events) - reported by a home network ...
show moreMultiple web server 400 error codes from same source ip. (1,808 events) - reported by a home network SIEM
show less
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ...
show moreHTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-mnz6-1)
show less
