🇧🇷
SOC-BR
2026-11-06 07:22:30
UTC ·
(5 minutes ago)
Attack detected by Fortinet - applications3: Vercel.Next.js.x-middleware-subrequest.Authentication.Bypass - 2026-11-05 11:39:36 - Source Port 40568
Port Scan
Hacking
🇫🇮
sibahota
2026-11-06 05:51:15
UTC ·
(1 hour ago)
34.30.148.61 - - [06/Nov/2026:05:51:14 +0000] admin.nidandiagnostic.com "GET /config.php.bak HTTP/2.0" 403 26 0.000 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" - - - "http://admin.nidandiagnostic.com"
34.30.148.61 - - [06/Nov/2026:05:51:14 +0000] ...
show more
34.30.148.61 - - [06/Nov/2026:05:51:14 +0000] admin.nidandiagnostic.com "GET /config.php.bak HTTP/2.0" 403 26 0.000 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" - - - "http://admin.nidandiagnostic.com"
34.30.148.61 - - [06/Nov/2026:05:51:14 +0000] admin.nidandiagnostic.com "GET /telescope/requests HTTP/2.0" 307 0 0.003 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" 172.17.0.1:3050 307 0.003 "http://admin.nidandiagnostic.com/telescope/requests"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 04:12:59
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.30.148.61 (61.148.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 23:12:55.715747 2026] [security2:error] [pid 24774:tid 24 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.30.148.61 (61.148.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 23:12:55.715747 2026] [security2:error] [pid 24774:tid 24774] [client 34.30.148.61:34414] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.ecuablue.farm"] [uri "/.env.supabase"] [unique_id "au1Tx-0gy7P0MJnR-M99rQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-06 03:51:26
UTC ·
(3 hours ago)
[mx01aln] Web exploit scanning: 5 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.30.148.61 - - [06/Nov/2026:04:51:22 +0100] "GET /storage/.env HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P ...
show more
[mx01aln] Web exploit scanning: 5 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.30.148.61 - - [06/Nov/2026:04:51:22 +0100] "GET /storage/.env HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
34.30.148.61 - - [06/Nov/2026:04:51:22 +0100] "GET /wp/.env HTTP/2.0" 404 2020 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.30.148.61 - - [06/Nov/2026:04:51:22 +0100] "GET /.env.swp HTTP/2.0" 404 2020 "-" "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
34.30.148.61 - - [06/Nov/2026:04:51:22 +0100] "GET /config/.env.php HTTP/2.0" 404 2020
...
show less
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-11-06 03:40:35
UTC ·
(3 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:29:28
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.30.148.61 (61.148.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:29:22.566138 2026] [security2:error] [pid 8056:tid 805 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.30.148.61 (61.148.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:29:22.566138 2026] [security2:error] [pid 8056:tid 8056] [client 34.30.148.61:57738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.childrenscliniciws.org"] [uri "/public../.env"] [unique_id "au1Jks_AjJ_FSDQSBzGeegAAAEs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
debestelapp
2026-11-06 01:50:14
UTC ·
(5 hours ago)
Web App Attack
🇧🇪
cmbplf
2026-11-06 01:05:48
UTC ·
(6 hours ago)
6.982 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇫🇷
LoneRider
2026-11-06 00:59:53
UTC ·
(6 hours ago)
[06/Nov/2026:01:59:50.326283 +0100] au0mhjOSQ18TWJugrMIqvgAAAAI 34.30.148.61 56534 127.0.0.1 7081
[06/Nov/2026:01:59:51.562519 +0100] au0mh9unOsp2XdYavwF_7wAAAAE 34.30.148.61 56758 127.0.0.1 7081
[06/Nov/2026:01:59:51.565766 +0100] au0mh5LVdGa-n2Sw0e ...
show more
[06/Nov/2026:01:59:50.326283 +0100] au0mhjOSQ18TWJugrMIqvgAAAAI 34.30.148.61 56534 127.0.0.1 7081
[06/Nov/2026:01:59:51.562519 +0100] au0mh9unOsp2XdYavwF_7wAAAAE 34.30.148.61 56758 127.0.0.1 7081
[06/Nov/2026:01:59:51.565766 +0100] au0mh5LVdGa-n2Sw0emuYAAAAAU 34.30.148.61 56800 127.0.0.1 7081
...
show less
Hacking
2026-11-06 00:50:48
UTC ·
(6 hours ago)
Attempted access to sensitive endpoint (/login) detected. Automated scan or unauthorized probing.
Web App Attack
🇺🇸
mw
2026-11-06 00:40:03
UTC ·
(6 hours ago)
GET /config/.env.php HTTP/1.1
Web App Attack
🇩🇪
EGP Abuse Dept
2026-11-06 00:21:11
UTC ·
(7 hours ago)
Scanning for web/db/file exploits on www.lookizi.nl
SQL Injection
Bad Web Bot
Web App Attack
🇫🇮
sibahota
2026-11-05 23:46:25
UTC ·
(7 hours ago)
34.30.148.61 - - [05/Nov/2026:23:46:24 +0000] www.nidandiagnostic.com "GET /z9x8c7v6b5-debug-trigger-www.nidandiagnostic.com HTTP/2.0" 403 26 0.000 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/g ...
show more
34.30.148.61 - - [05/Nov/2026:23:46:24 +0000] www.nidandiagnostic.com "GET /z9x8c7v6b5-debug-trigger-www.nidandiagnostic.com HTTP/2.0" 403 26 0.000 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" - - - "http://www.nidandiagnostic.com"
34.30.148.61 - - [05/Nov/2026:23:46:24 +0000] www.nidandiagnostic.com "GET /7nq3wt6e2mkx5yc6a962 HTTP/2.0" 403 26 0.000 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" - - - "http://www.nidandiagnostic.com"
...
show less
Bad Web Bot
🇫🇷
SpaceHost-Server
2026-11-05 23:19:53
UTC ·
(8 hours ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 23:10:18
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.30.148.61 (61.148.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 18:10:12.055103 2026] [security2:error] [pid 31646:tid 31 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.30.148.61 (61.148.30.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 18:10:12.055103 2026] [security2:error] [pid 31646:tid 31646] [client 34.30.148.61:54748] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nnrentacar.com|F|2"] [data ".nnrentacar.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nnrentacar.com"] [uri "/z9x8c7v6b5-debug-trigger-www.nnrentacar.com"] [unique_id "au0M1BcHG8tUZv8e069pfQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
