🇺🇸
helios.live
2026-11-06 18:57:30
UTC ·
(42 minutes ago)
2026/11/06 18:57:27 [error] 2645152#2645152: *1877712 access forbidden by rule, client: 34.146.24.216, server: kocerroxy.com, request: "GET /.vite/manifest.json HTTP/1.1", host: "app.kocerroxy.com"
2026/11/06 18:57:27 [error] 2645152#2645152: *187771 ...
show more
2026/11/06 18:57:27 [error] 2645152#2645152: *1877712 access forbidden by rule, client: 34.146.24.216, server: kocerroxy.com, request: "GET /.vite/manifest.json HTTP/1.1", host: "app.kocerroxy.com"
2026/11/06 18:57:27 [error] 2645152#2645152: *1877712 access forbidden by rule, client: 34.146.24.216, server: kocerroxy.com, request: "GET /dist/.vite/manifest.json HTTP/1.1", host: "app.kocerroxy.com"
2026/11/06 18:57:28 [error] 2645152#2645152: *1877712 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 34.146.24.216, server: kocerroxy.com, request: "GET /laravel../config/database.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "app.kocerroxy.com"
34.146.24.216 - - [06/Nov/2026:18:57:28 +0000] "GET /laravel../config/database.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)"
2026/11/06 18:57:30 [error] 2645152#2645152: *1878027 access forbidden b
...
show less
Web App Attack
🇦🇺
Klaverstyn
2026-11-06 17:37:51
UTC ·
(2 hours ago)
Cross-vhost secrets/RCE probing campaign
Web App Attack
Hacking
🇬🇧
consul.to
2026-11-06 16:22:42
UTC ·
(3 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
middelkoopcc
2026-11-06 14:07:01
UTC ·
(5 hours ago)
2026-11-06 15:05:54 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 2026-11-06 15:05:54 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env) && 2026-11-06 15:05:54 AH10244: invalid URI path (/%2E%2E/%2E% ...
show more
2026-11-06 15:05:54 AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ) && 2026-11-06 15:05:54 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env) && 2026-11-06 15:05:54 AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ) && 189 more within 20 minutes
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 13:38:28
UTC ·
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.146.24.216 (216.24.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:38:24.898995 2026] [security2:error] [pid 3839:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.146.24.216 (216.24.146.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:38:24.898995 2026] [security2:error] [pid 3839:tid 3839] [client 34.146.24.216:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.kidswithcamerasmovie.com"] [uri "/api/system/fileView"] [unique_id "au3YUN7-dLoHWPdqLIORIAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Kitki30.com
2026-11-06 11:21:26
UTC ·
(8 hours ago)
HTTP Probing (server 1). Log: 34.146.24.216 - - [06/Nov/2026:11:21:25 +0000] "GET /laravel/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.146.24.216 - - [06/No ...
show more
HTTP Probing (server 1). Log: 34.146.24.216 - - [06/Nov/2026:11:21:25 +0000] "GET /laravel/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
34.146.24.216 - - [06/Nov/2026:11:21:25 +0000] "GET /.env.supabase HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-11-06 11:13:27
UTC ·
(8 hours ago)
(PERMBLOCK) 34.146.24.216 (JP/Japan/216.24.146.34.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
Port Scan
2026-11-06 11:10:28
UTC ·
(8 hours ago)
[Laravel HoneypotPlus] Automated report - Honeypot access detected on path: /config/firebase-admin.json via rule: /config
Web App Attack
Bad Web Bot
🇳🇱
Alt255
2026-11-06 10:21:47
UTC ·
(9 hours ago)
[ti-02ov] Web exploit scanning: 3 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.146.24.216 - - [06/Nov/2026:11:21:34 +0100] "GET /.env.credentials HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi ...
show more
[ti-02ov] Web exploit scanning: 3 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.146.24.216 - - [06/Nov/2026:11:21:34 +0100] "GET /.env.credentials HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)"
34.146.24.216 - - [06/Nov/2026:11:21:34 +0100] "GET /.env.dev.local HTTP/2.0" 403 538 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)"
34.146.24.216 - - [06/Nov/2026:11:21:34 +0100] "GET /.env.secret HTTP/2.0" 403 538 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
pachec
2026-11-06 10:18:28
UTC ·
(9 hours ago)
Automated vulnerability scanning blocked by fail2ban
Web App Attack
Hacking
🇳🇱
johnson-oragui
2026-11-06 01:04:17
UTC ·
(18 hours ago)
Banned automatically by Fail2ban jail: custom-nginx-429
Web App Attack
2026-11-05 16:32:38
UTC ·
(1 day ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
snappic
2026-11-05 01:56:43
UTC ·
(1 day ago)
Scanning for .env files [GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env] [Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)]
Bad Web Bot
Web App Attack
2026-11-05 01:50:06
UTC ·
(1 day ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
SX Communications
2026-11-05 00:51:58
UTC ·
(1 day ago)
Web vulnerability scanning / probing from 34.146.24.216: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 77 hits; paths: /api/system/fileView?file=/proc/self/environ, /document.php?modulepa ...
show more
Web vulnerability scanning / probing from 34.146.24.216: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 77 hits; paths: /api/system/fileView?file=/proc/self/environ, /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared, /userfiles?path=../../.env, /graphql, /.amplifyrc.
show less
Port Scan
Hacking
Web App Attack
