Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show moreAuto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-14.
show less
(mod_security) mod_security (id:930130) triggered by 34.90.174.88 (88.174.90.34.bc.googleusercontent ...
show more(mod_security) mod_security (id:930130) triggered by 34.90.174.88 (88.174.90.34.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
show less
Automated GCE scanner hit a host with 40+ requests: php://input remote code execution probes against ...
show moreAutomated GCE scanner hit a host with 40+ requests: php://input remote code execution probes against php-cgi paths plus enumeration of .env, terraform, and firebase config files; all returned 403/404.
Target: HTTP 80/443: POST /cgi-bin/php-cgi.exe and /php-cgi/php-cgi.exe with allow_url_include=1&auto_prepend_file=php://input; GET /.env, /.terraform/terraform.tfstate, /prisma/.env, /firebase-config.js
Seen: 2026-10-14 10:44 EDT
- 2026-10-14 10:44:34 POST /cgi-bin/php-cgi.exe?allow_url_include=1&auto_prepend_file=php://input returned 404 (PHP code-execution attempt)
- 2026-10-14 10:44:34 POST /php-cgi/php-cgi.exe?allow_url_include=1&auto_prepend_file=php://input returned 404 (PHP code-execution attempt)
- 2026-10-14 10:44:31 GET /.terraform/terraform.tfstate returned 403 (secret/config enumeration)
- 2026-10-14 10:44:32 GET /prisma/.env returned 403 and GET /supabase/.env returned 403 (secret/config enumeration)
show less
Blocked by CSF 13 firewall - Rule: config-dotfile
US/United States/88.174.90.34.bc.googleusercontent ...
show moreBlocked by CSF 13 firewall - Rule: config-dotfile
US/United States/88.174.90.34.bc.googleusercontent.com
show less
{"level":"info","ts":1791982356.392918,"logger":"http.log.access.log0","msg":"handled request","requ ...
show more{"level":"info","ts":1791982356.392918,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"34.90.174.88","remote_port":"54000","client_ip":"34.90.174.88","proto":"HTTP/2.0","method":"GET","host":"nc6y.status.updown.io","uri":"/images../.env","headers":{"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"],"Accept":["*/*"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"nc6y.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000103728,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1791982356.4009888,"logger":"http.log.access.log
...
show less