🇩🇪
updown.io
2026-10-09 23:50:48
(2 days ago)
{"level":"info","ts":1791589841.7938845,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791589841.7938845,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.234.54.129","remote_port":"55830","client_ip":"35.234.54.129","proto":"HTTP/2.0","method":"POST","host":"status.funkhaus.us","uri":"/graphql","headers":{"Content-Type":["application/json"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Fetch-Dest":["empty"],"Referer":["https://status.funkhaus.us"],"Accept":["*/*"],"Sec-Fetch-Mode":["cors"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Content-Length":["86"],"Priority":["u=1, i"],"Sec-Fetch-Site":["same-origin"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Origin":["https://status.funkhaus.us"],"Sec-Ch-Ua-Mobile":["?0"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Sec-Ch-Ua-Platform":["\"Windows\""]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.funkh
...
show less
DDoS Attack
Web App Attack
🇫🇷
phoenix1jl96
2026-10-09 22:30:47
(2 days ago)
2026/10/10 00:30:46 [error] 4800#4800: *81418 open() "/home/user-data/www/default/cgi-bin/php-cgi.ex ...
show more
2026/10/10 00:30:46 [error] 4800#4800: *81418 open() "/home/user-data/www/default/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 35.234.54.129, server: box.ledemon.us, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "splunk.ledemon.us"
2026/10/10 00:30:46 [error] 4800#4800: *81418 open() "/home/user-data/www/default/cgi-bin/php" failed (2: No such file or directory), client: 35.234.54.129, server: box.ledemon.us, request: "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "splunk.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 13:10:07
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 09:10:01.540829 2026] [security2:error] [pid 26397:tid 26397] [client 35.234.54.129:44848] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.starvationacres.us"] [uri "/.htpasswd"] [unique_id "asjnqXavRcnoQK3XzLC3IgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 12:51:03
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 08:50:55.601057 2026] [security2:error] [pid 11130:tid 11192] [client 35.234.54.129:34628] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.jahr.us"] [uri "/images../.env"] [unique_id "asjjLymMNvfq7p5tynDQbQAAAUU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
masterguru
2026-10-09 12:50:44
(3 days ago)
BAD BOT - Detected and Blocked.. Matched phrase "baidu" at REQUEST_HEADERS:user-agent. (1100000-164)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-09 12:32:49
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 08:32:46.585298 2026] [security2:error] [pid 14651:tid 14651] [client 35.234.54.129:36522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.bioprotec.us"] [uri "/.htpasswd"] [unique_id "asje7ipBfnKIS4W1lOOINgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 09:15:53
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 05:15:48.756951 2026] [security2:error] [pid 25933:tid 25933] [client 35.234.54.129:45792] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "inwriting.englishmagic.us"] [uri "/static../.env"] [unique_id "asiwxO4eXEdhNmAz57LxDAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
CBJ
2026-10-09 06:49:46
(3 days ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 06:11:45
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 02:11:40.436886 2026] [security2:error] [pid 6774:tid 6774] [client 35.234.54.129:51960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "files.cswiki.us"] [uri "/userfiles"] [unique_id "asiFnLdIYHxOTcCssIMWyQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
phoenix1jl96
2026-10-09 05:49:13
(3 days ago)
2026/10/09 07:49:12 [error] 4800#4800: *65740 open() "/home/user-data/www/default/cgi-bin/php-cgi.ex ...
show more
2026/10/09 07:49:12 [error] 4800#4800: *65740 open() "/home/user-data/www/default/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 35.234.54.129, server: box.ledemon.us, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "faq.ledemon.us"
2026/10/09 07:49:12 [error] 4800#4800: *65740 open() "/home/user-data/www/default/cgi-bin/php" failed (2: No such file or directory), client: 35.234.54.129, server: box.ledemon.us, request: "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "faq.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
2026-10-08 20:21:31
(3 days ago)
35.234.54.129 - - [08/Oct/2026:16:21:31 -0400] "GET /z9x8c7v6b5-debug-trigger-api.llamadareal.us HTT ...
show more
35.234.54.129 - - [08/Oct/2026:16:21:31 -0400] "GET /z9x8c7v6b5-debug-trigger-api.llamadareal.us HTTP/1.1" 401 703 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Brute-Force
Web App Attack
SSH
🇫🇷
phoenix1jl96
2026-10-08 19:52:58
(3 days ago)
2026/10/08 21:52:56 [error] 4800#4800: *55388 open() "/home/user-data/www/default/cgi-bin/php-cgi.ex ...
show more
2026/10/08 21:52:56 [error] 4800#4800: *55388 open() "/home/user-data/www/default/cgi-bin/php-cgi.exe" failed (2: No such file or directory), client: 35.234.54.129, server: box.ledemon.us, request: "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.ledemon.us"
2026/10/08 21:52:57 [error] 4800#4800: *55388 open() "/home/user-data/www/default/cgi-bin/php" failed (2: No such file or directory), client: 35.234.54.129, server: box.ledemon.us, request: "POST /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0", host: "admin.ledemon.us"
...
show less
DNS Compromise
DNS Poisoning
DDoS Attack
Ping of Death
Web Spam
Email Spam
Blog Spam
Port Scan
Hacking
Brute-Force
Bad Web Bot
SSH
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 19:46:07
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 15:46:02.207866 2026] [security2:error] [pid 25895:tid 25895] [client 35.234.54.129:40054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "account.scc1.us"] [uri "/static//home/user/.env"] [unique_id "asfy-qmoiDJtmRnR9LsMXQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 19:27:18
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.54.129 (129.54.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 15:27:10.996513 2026] [security2:error] [pid 31948:tid 31948] [client 35.234.54.129:39110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "the-burkes.us"] [uri "/.htpasswd"] [unique_id "asfujofZIEkKtflzlb9jHAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-08 19:08:05
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
