🇺🇸
TPI-Abuse
2026-07-25 00:43:48
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 20:43:42.084578 2026] [security2:error] [pid 1485087:tid 1485087] [client 185.95.103.112:39163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.3905ccn.org|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.3905ccn.org"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amQGvuvhZRemeFR7SnZvEAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 23:05:29
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 19:05:23.380679 2026] [security2:error] [pid 273633:tid 273670] [client 185.95.103.112:34841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||velatorioslucenses.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "velatorioslucenses.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amPvs6lttaIiwBO9PYo3mAAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 20:32:11
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 16:32:05.940146 2026] [security2:error] [pid 31145:tid 31145] [client 185.95.103.112:43297] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||puckerbikini.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "puckerbikini.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amPLxYqWhwTF9Ry6N9HSXAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 19:31:09
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 15:31:00.694926 2026] [security2:error] [pid 258827:tid 258827] [client 185.95.103.112:38133] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||kathyquan.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "kathyquan.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amO9dGtNBeUIRa2VVYkBewAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 18:37:55
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 14:37:50.993078 2026] [security2:error] [pid 3012907:tid 3012907] [client 185.95.103.112:45697] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||greatplainswingcaf.org|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "greatplainswingcaf.org"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amOw_h6LbpDEu6VE6TJepgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 18:06:49
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 14:06:44.328603 2026] [security2:error] [pid 940904:tid 940904] [client 185.95.103.112:38009] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||banis-associates.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "banis-associates.com"] [uri "/index.php"] [unique_id "amOptGKKj6pU3gNh3jLEvAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 17:37:39
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 13:37:30.521792 2026] [security2:error] [pid 660350:tid 660350] [client 185.95.103.112:38177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||coolingsprings.org|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "coolingsprings.org"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amOi2i7gZWAxWOg5tQwPxQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 17:06:58
(1 day ago)
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 185.95.103.112 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 13:06:55.219647 2026] [security2:error] [pid 4039508:tid 4039508] [client 185.95.103.112:33193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||advancedmotorsports.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "advancedmotorsports.com"] [uri "/php-cgi/php.exe"] [unique_id "amObr6ZFqRY5CRIGCQN_jQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack