This IP address has been reported a total of
28
times from
26 distinct
sources.
34.89.140.182 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 10
reports;
Netherlands
with 6
reports;
Czechia
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
22
times;
Hacking
10
times;
Bad Web Bot
7
times;
Brute-Force
5
times;
SQL Injection
2
times;
Other
11
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Inbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/ ...
show moreInbound web exploitation attempt detected and blocked by perimeter IDS/IPS.
Observed 1 blocked IDS/IPS event.
Observed IDS/IPS evidence:
- ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)
Target service: HTTP / TCP port 80
Severity: 9/10
First seen: 2026-10-14T12:54:03.124Z
Last seen: 2026-10-14T12:54:03.124Z
Reference: STI-20261014-145403-34-89-140-182
show less
Hacking
Web App Attack
Anonymous
Web reconnaissance and sensitive configuration file search.
Bad Web Bot
Web App Attack
Hacking
Anonymous
Detected by CrowdSec: crowdsecurity/http-sensitive-files
Automated web application probing detected against a public web server.
13 suspicious requests
12 c ...
show moreAutomated web application probing detected against a public web server.
13 suspicious requests
12 critical requests
Observed requests:
POST /login
POST /graphql
POST /api/graphql
GET /z9x8c7v6b5-debug-trigger-gateway.mrsky.nl
Risk level: CRITICAL
Reference: STI-20261014-151520-34-89-140-182
show less
Hacking
Web App Attack
Anonymous
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
(apache-useragents) Failed apache-useragents trigger with match [redacted]): (CF_ENABLE)
Bad Web Bot
Anonymous
Bot / scanning and/or hacking attempts: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/. ...
show moreBot / scanning and/or hacking attempts: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e, POST /form/ HTTP/2.0, POST /webhook/ HTTP/2.0, POST /webhook-test/ HTTP/2.0, POST /cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_fil, POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%, POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_, POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend, POST /read-document HTTP/2.0, POST /api/v1/node-load-method/customMCP HTTP/2.0, POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_, POST /flowise/api/v1/node-load-method/customMCP HTTP/2.0, POST /exec-py HTTP/2.0
show less
{"level":"info","ts":1791972740.063224,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more{"level":"info","ts":1791972740.063224,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.89.140.182","remote_port":"58414","client_ip":"34.89.140.182","proto":"HTTP/2.0","method":"GET","host":"status.verizonvideoplus.com","uri":"/files../.env","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.verizonvideoplus.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.000126271,"size":0,"status":429,"resp_headers":{"Retry-After":["1"],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
{"level":"info","ts":1791972740.0647035,"logger":"http.log.
...
show less
