🇸🇬
simpeg-adm.bandung.go.id
2026-10-12 23:26:03
(2 days ago)
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/sbn7vi8j7952ne2vifwx"
12/Oct/2026:23:26:02 +0000;35.204.1 ...
show more
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/sbn7vi8j7952ne2vifwx"
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/dist/manifest.json"
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/yv4gwff2xbjbc60ek44a"
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/dist/.vite/manifest.json"
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/lib/terminal-xhr.php"
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/z9x8c7v6b5-debug-trigger-app.evka.com.au"
12/Oct/2026:23:26:02 +0000;35.204.10.180;"/.vite/manifest.json"
...
show less
Web Spam
Brute-Force
Web App Attack
🇦🇺
BoredManCodes
2026-10-12 23:04:31
(2 days ago)
Scanner probing for secrets/webshells on an API host: GET /.next/build-manifest.json. Hit a honeypot ...
show more
Scanner probing for secrets/webshells on an API host: GET /.next/build-manifest.json. Hit a honeypot path that serves nothing real.
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-12 21:47:58
(2 days ago)
[Tue Oct 13 08:47:56.766645 2026] [security2:error] [pid 174046] [client 35.204.10.180:44788] [clien ...
show more
[Tue Oct 13 08:47:56.766645 2026] [security2:error] [pid 174046] [client 35.204.10.180:44788] [client 35.204.10.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/static../.env"] [unique_id "as1VjKWZZPWbA6Rp_3uXRAAAAAc"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 20:37:35
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.204.10.180 (180.10.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.10.180 (180.10.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 16:37:32.260475 2026] [security2:error] [pid 25155:tid 25155] [client 35.204.10.180:43500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rentaroller.com.au"] [uri "/.htpasswd"] [unique_id "as1FDNK4Q_kEfujnX4cBSQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 19:55:39
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 35.204.10.180 (180.10.204.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.204.10.180 (180.10.204.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 15:55:32.181011 2026] [security2:error] [pid 8431:tid 8431] [client 35.204.10.180:42046] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newlife.org.au"] [uri "/web/.env"] [unique_id "as07NEFjMum_xEDqzmL4LQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
A.i.D.A.N.N
2026-10-12 19:52:31
(2 days ago)
A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web vulnerability scanning detected
Web App Attack
🇦🇺
Klaverstyn
2026-10-12 19:01:39
(2 days ago)
High-volume automated HTTP scanning
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-12 18:26:50
(2 days ago)
[Tue Oct 13 05:26:49.428105 2026] [security2:error] [pid 152474] [client 35.204.10.180:58320] [clien ...
show more
[Tue Oct 13 05:26:49.428105 2026] [security2:error] [pid 152474] [client 35.204.10.180:58320] [client 35.204.10.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellagiftware.com.au"] [uri "/build../.env"] [unique_id "as0maVwPfREhZhTxJa3glgAAAAU"]
...
show less
Web App Attack
🇦🇺
Klaverstyn
2026-10-12 18:01:38
(2 days ago)
Excessive HTTP request rate
Web App Attack
🇦🇺
Asimar
2026-10-12 17:23:51
(2 days ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted]): (CF_ENABLE)
Bad Web Bot
🇦🇺
ghel
2026-10-12 15:51:05
(2 days ago)
35.204.10.180 - - [12/Oct/2026:23:50:48 +0800] "GET /asset-manifest.json HTTP/1.1" 404 127617 "-" "M ...
show more
35.204.10.180 - - [12/Oct/2026:23:50:48 +0800] "GET /asset-manifest.json HTTP/1.1" 404 127617 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
35.204.10.180 - - [12/Oct/2026:23:50:49 +0800] "GET /dist/manifest.json HTTP/1.1" 404 127617 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
35.204.10.180 - - [12/Oct/2026:23:50:48 +0800] "GET /oe701cjyy6d65zlff80z HTTP/1.1" 404 131560 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
35.204.10.180 - - [12/Oct/2026:23:50:49 +0800] "GET /assets/manifest.json HTTP/1.1" 404 131560 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
35.204.10.180 - - [12/Oct/2026:23:50:48 +0800] "POST /lib/terminal-xhr.php HTTP/1.1" 404 131535 "-" "Mozilla/5.0 Appl
...
show less
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-12 14:46:21
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇦🇺
2000cn.com.au
2026-10-12 14:38:59
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇦🇺
Bay13
2026-10-12 14:29:14
(3 days ago)
CrowdSec:custom/http-probing
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-12 13:36:07
(3 days ago)
[Tue Oct 13 00:36:06.874831 2026] [security2:error] [pid 124406] [client 35.204.10.180:57452] [clien ...
show more
[Tue Oct 13 00:36:06.874831 2026] [security2:error] [pid 124406] [client 35.204.10.180:57452] [client 35.204.10.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dance4fitness.com.au"] [uri "/.git/HEAD"] [unique_id "asziRtJuzDlBGDksZm4xBQAAAAg"]
...
show less
Web App Attack
