🇩🇪
updown.io
2026-10-11 10:00:02
(19 hours ago)
{"level":"info","ts":1791712799.159266,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1791712799.159266,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.159.121.161","remote_port":"43340","client_ip":"34.159.121.161","proto":"HTTP/2.0","method":"GET","host":"status.gogn.in","uri":"/cache/original/%2e%2e/.env","headers":{"Accept":["*/*"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.gogn.in","ech":false}},"bytes_read":0,"user_id":"","duration":0.000808353,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1791712799.1604204,"logger":"http.log.access.log1","msg":"handled request"
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 04:19:40
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.159.121.161 (161.121.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 34.159.121.161 (161.121.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 00:19:32.348930 2026] [security2:error] [pid 1116:tid 1116] [client 34.159.121.161:46902] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.technlunch.blog|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.technlunch.blog"] [uri "/rclone.conf"] [unique_id "assOVL2gBZessgBiWLU2uAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
sibahota
2026-10-10 22:21:43
(1 day ago)
34.159.121.161 - - [10/Oct/2026:22:21:41 +0000] campaigns.dexcy.in "GET /.gitlab-ci.yml HTTP/2.0" 40 ...
show more
34.159.121.161 - - [10/Oct/2026:22:21:41 +0000] campaigns.dexcy.in "GET /.gitlab-ci.yml HTTP/2.0" 403 26 0.000 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" - - - "http://campaigns.dexcy.in"
34.159.121.161 - - [10/Oct/2026:22:21:41 +0000] campaigns.dexcy.in "GET /firebase-service-account.json HTTP/2.0" 403 26 0.000 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" - - - "http://campaigns.dexcy.in"
...
show less
Bad Web Bot
2026-10-10 22:07:39
(1 day ago)
34.159.121.161 - - [11/Oct/2026:00:07:38 +0200] "GET /admin/.env HTTP/1.1" 404 467 "-" "CCBot/2.0 (h ...
show more
34.159.121.161 - - [11/Oct/2026:00:07:38 +0200] "GET /admin/.env HTTP/1.1" 404 467 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
...
show less
Brute-Force
Web App Attack
2026-10-10 21:06:02
(1 day ago)
Trying to access config files
Web App Attack
2026-10-10 20:03:30
(1 day ago)
34.159.121.161 - - [10/Oct/2026:20:03:29 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env HTTP/1.1" 400 ...
show more
34.159.121.161 - - [10/Oct/2026:20:03:29 +0000] "GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env HTTP/1.1" 400 512 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Brute-Force
Web App Attack
2026-10-10 19:14:33
(1 day ago)
[Sat Oct 10 21:14:32.582400 2026] [authz_core:error] [pid 674862] [client 34.159.121.161:42266] AH01 ...
show more
[Sat Oct 10 21:14:32.582400 2026] [authz_core:error] [pid 674862] [client 34.159.121.161:42266] AH01630: client denied by server configuration: /var/www/html/default/
[Sat Oct 10 21:14:32.594119 2026] [authz_core:error] [pid 674862] [client 34.159.121.161:42266] AH01630: client denied by server configuration: /var/www/html/default/app
[Sat Oct 10 21:14:32.610041 2026] [authz_core:error] [pid 674862] [client 34.159.121.161:42266] AH01630: client denied by server configuration: /var/www/html/default/secure
[Sat Oct 10 21:14:32.614051 2026] [authz_core:error] [pid 674860] [client 34.159.121.161:42274] AH01630: client denied by server configuration: /var/www/html/default/portal
[Sat Oct 10 21:14:32.625310 2026] [authz_core:error] [pid 674860] [client 34.159.121.161:42274] AH01630: client denied by server configuration: /var/www/html/default/reset-password
...
show less
Web App Attack
2026-10-10 18:34:08
(1 day ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇨🇭
Sonics
2026-10-10 18:28:08
(1 day ago)
Automated scanner: .env/.git/phpinfo scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 18:23:38
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.159.121.161 (161.121.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.121.161 (161.121.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 14:23:33.261963 2026] [security2:error] [pid 32422:tid 32422] [client 34.159.121.161:52134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pentesters.in"] [uri "/@fs/../.env"] [unique_id "asqCpb_c16_Ofhpv6RDDNwAAAFc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 17:38:31
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.159.121.161 (161.121.159.34.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 34.159.121.161 (161.121.159.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 13:38:24.191662 2026] [security2:error] [pid 29233:tid 29233] [client 34.159.121.161:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chaitanyaconsult.in"] [uri "/@fs/src/.env"] [unique_id "asp4EJc_xMtzTnppGvyTFQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-10 16:55:23
(1 day ago)
Web application attack detected.
Web App Attack
🇬🇧
consul.to
2026-10-10 16:31:12
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇮🇳
Mr.Singh
2026-10-10 15:30:28
(1 day ago)
NFT blocked 34.159.121.161 after 2 rejections on 10-Oct-2026.
Port Scan
Brute-Force
