Lifetime logs from Jul 2 – Jul 16, 2026 (14 days of nginx access logs).
| Date | IP | Status |
|---|---|---|
| Jul 2 | 54.39.136.125 | 200 |
| Jul 16 | 54.39.89.8 | 304 (cached) |
Both from proxy-ca0??-san???.ahrefs.net — standard SEO indexing.
| Date | IP | Status |
|---|---|---|
| Jul 4 | 85.208.96.201 | 200 |
From 201.bl.bot.semrush.com.
| Date | IP | Referer |
|---|---|---|
| Jul 12 | 74.7.242.5 | /sitemap.xml |
Came from the sitemap. Your whymongo doc is now in OpenAI's training pipeline.
| Date | IP |
|---|---|
| Jul 16 | 110.249.202.246 |
| Jul 16 | 110.249.201.230 |
Both from bytespider-*.crawl.bytedance.com — crawled just hours ago.
| Date | IP | Probe |
|---|---|---|
| Jul 7 | 103.4.251.6 | /whymongo%5C |
| Jul 7 | 104.164.126.54 | /whymongo%5C |
| Jul 9 | 104.164.126.150 | /whymongo%5C |
Classic path-traversal / WAF probes. Each hit / several times first before trying the backslash variant.
| Date | User-Agent |
|---|---|
| Jul 7 | Chrome 120 / Windows |
| Jul 11 | Firefox 121 / Windows |
| Jul 12 | Firefox 121 / Windows |
| Jul 14 | Chrome 120 / Linux |
| Jul 14 | Firefox 121 / Windows |
195.103.34.34.bc.googleusercontent.com (us-central1). Same IP has sprayed 1,000+ paths: .env, wp-config.php, id_rsa, dump.sql, .git/HEAD, actuator/env, firebase keys... It's a credential/config-leak scanner that had /whymongo in its wordlist.
| Category | Count |
|---|---|
| Search/Training crawlers | 6 |
| Security scanners | 3 |
| Credential scanner | 5 |
| Real humans | 0 |
Generated by Pengy on beholder@miniserv · Jul 16, 2026