🇸🇬
simpeg-adm.bandung.go.id
2026-10-05 23:15:13
UTC ·
(1 month ago)
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/lib/terminal-xhr.php"
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/z9x8c7v6b5-debug-trigger-app.flurogrey.com"
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/80p40bovop1uqsfwedts"
05/Oct/2026:23:15:11 +0000;35.243 ...
show more
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/lib/terminal-xhr.php"
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/z9x8c7v6b5-debug-trigger-app.flurogrey.com"
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/80p40bovop1uqsfwedts"
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/c11wclcxhqpfsvyxi106"
05/Oct/2026:23:15:11 +0000;35.243.47.109;"/.vite/manifest.json"
05/Oct/2026:23:15:12 +0000;35.243.47.109;"/dist/.vite/manifest.json"
05/Oct/2026:23:15:12 +0000;35.243.47.109;"/icecoder/lib/terminal-xhr.php"
...
show less
Web Spam
Brute-Force
Web App Attack
2026-10-05 20:01:06
UTC ·
(1 month ago)
Web App Attack
🇺🇸
deskpass.com
2026-10-05 18:53:22
UTC ·
(1 month ago)
POST /index.php
Web App Attack
🇺🇸
micropedro
2026-10-05 15:20:30
UTC ·
(1 month ago)
3 incidents: web scanning/attack. First: 2026-10-05 02:07, Last: 2026-10-05 11:20 UTC. Triggers: nginx-noscript,unknown,nginx-botsearch.
Port Scan
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-10-05 15:20:04
UTC ·
(1 month ago)
Webpage scraping
Brute-Force
Bad Web Bot
Web App Attack
🇨🇷
Klicks
2026-10-05 13:35:00
UTC ·
(1 month ago)
Request URL: https://1.com:443/trace.axd
Request path: /trace.axd
User host address: 35.243.47.109
Bad Web Bot
Web App Attack
Web Spam
🇳🇱
middelkoopcc
2026-10-05 12:25:01
UTC ·
(1 month ago)
2026-10-05 14:23:14 AH01264: stderr from /<redacted>/cgi-bin/php-cgi.exe: script not found or unable to stat, referer https://account.companeros.com/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input && 2026-10-05 14: ...
show more
2026-10-05 14:23:14 AH01264: stderr from /<redacted>/cgi-bin/php-cgi.exe: script not found or unable to stat, referer https://account.companeros.com/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input && 2026-10-05 14:23:00 GET /asset-manifest.json [404] && 2026-10-05 14:23:14 AH01264: stderr from /<redacted>/cgi-bin/php: script not found or unable to stat, referer https://account.companeros.com/cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input && 98 more within 20 minutes
show less
Web App Attack
🇿🇦
conure.sh
2026-10-05 12:05:36
UTC ·
(1 month ago)
csagent: score 19.7: 404 noise floor x39, secrets grab x1; 1 domain(s) in 2s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 11:29:40
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.243.47.109 (109.47.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:29:34.741305 2026] [security2:error] [pid 3939:tid 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 35.243.47.109 (109.47.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 07:29:34.741305 2026] [security2:error] [pid 3939:tid 3939] [client 35.243.47.109:45168] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||venturecg.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "venturecg.com"] [uri "/z9x8c7v6b5-debug-trigger-venturecg.com"] [unique_id "asOKHl_n7Hdhw5Gx7aJXHgAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-05 10:07:03
UTC ·
(1 month ago)
Automated web scanner. Requested suspicious paths: /dist/.vite/manifest.json | /.vite/manifest.json | /dist/manifest.json | /build/manifest.json | /z9x8c7v6b5-debug-trigger-tigzig.com. UTC: 2026-10-05 09:53:04.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 09:46:30
UTC ·
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 35.243.47.109 (109.47.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 05:46:25.428192 2026] [security2:error] [pid 22103:tid ...
show more
(mod_security) mod_security (id:949110) triggered by 35.243.47.109 (109.47.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 05:46:25.428192 2026] [security2:error] [pid 22103:tid 22103] [client 35.243.47.109:58016] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "theshitmyaisays.com"] [uri "/z9x8c7v6b5-debug-trigger-theshitmyaisays.com"] [unique_id "asNx8dIgjZVy8EixG_SMnwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-05 09:17:36
UTC ·
(1 month ago)
35.243.47.109 - - [05/Oct/2026:09:17:35 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
35.2 ...
show more
35.243.47.109 - - [05/Oct/2026:09:17:35 +0000] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
35.243.47.109 - - [05/Oct/2026:09:17:36 +0000] "POST /cgi-bin/php-cgi?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input HTTP/2.0" 404 107 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 09:15:28
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 35.243.47.109 (109.47.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 05:15:21.947237 2026] [security2:error] [pid 23396:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 35.243.47.109 (109.47.243.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 05:15:21.947237 2026] [security2:error] [pid 23396:tid 23396] [client 35.243.47.109:33230] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||syscoxlegends.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "syscoxlegends.com"] [uri "/z9x8c7v6b5-debug-trigger-syscoxlegends.com"] [unique_id "asNqqSvn0gmKn-tKxyyHAwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-10-05 08:56:54
UTC ·
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.243.47.109 (US/United States/109.47.243.35.bc.googleusercontent.com)
Bad Web Bot
🇷🇴
iulianh
2026-10-05 07:29:48
UTC ·
(1 month ago)
80,443
Brute-Force
SSH
