🇮🇪
RoboSOC
2026-06-19 08:54:52
(5 days ago)
PHP CGI Argument Injection Vulnerability, PTR: PTR record not found
Hacking
🇺🇸
TPI-Abuse
2026-06-19 06:31:56
(5 days ago)
(mod_security) mod_security (id:218420) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:218420) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 02:31:52.714712 2026] [security2:error] [pid 20184:tid 20184] [client 8.137.38.98:42426] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.creertest.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.creertest.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ajTiWFAUYgxySjnaygxgEgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇪
Jim Keir
2026-06-10 00:41:54
(2 weeks ago)
2026-06-10 00:41:54 8.137.38.98 File scanning, blocking 8.137.38.98 for 5 minutes
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 22:19:00
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 18:18:56.174189 2026] [security2:error] [pid 22594:tid 22594] [client 8.137.38.98:39292] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.todi.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.todi.org"] [uri "/php-cgi/php.exe"] [unique_id "aiiRUEZUDXmv70ls_pcR-AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 21:19:57
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 17:19:49.310960 2026] [security2:error] [pid 22184:tid 22184] [client 8.137.38.98:40484] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rochesterhistorical.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rochesterhistorical.org"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aiiDde3ljboCCWiPSwoTCwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 20:54:48
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 16:54:41.077866 2026] [security2:error] [pid 14491:tid 14491] [client 8.137.38.98:39264] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.peacecampus.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.peacecampus.org"] [uri "/php-cgi/php.exe"] [unique_id "aih9ke5PGes3eKJFjMSypQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 20:15:34
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 16:15:30.940102 2026] [security2:error] [pid 31069:tid 31069] [client 8.137.38.98:37712] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.marxistphilosophy.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.marxistphilosophy.org"] [uri "/cgi-bin/php.exe"] [unique_id "aih0YigvOM5NTUmFmNK79QAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 18:02:11
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 14:02:04.824946 2026] [security2:error] [pid 4326:tid 4326] [client 8.137.38.98:53296] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expertprofessionalcleaners.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expertprofessionalcleaners.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aihVHITEk7G6-FyTVy7qkQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 15:08:07
(2 weeks ago)
(mod_security) mod_security (id:218420) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:218420) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 11:08:03.096765 2026] [security2:error] [pid 11588:tid 11663] [client 8.137.38.98:50164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.kandooo.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.kandooo.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aigsU4pfdIqB_CiRpSsXBAAAAMY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 14:38:13
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 10:38:06.208565 2026] [security2:error] [pid 16975:tid 16975] [client 8.137.38.98:57616] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.AkronPartyBuses.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.akronpartybuses.com"] [uri "/php-cgi/php.exe"] [unique_id "aiglTijgycSsYO2d9No99gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 22:39:58
(2 weeks ago)
(mod_security) mod_security (id:218420) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:218420) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 18:39:52.814052 2026] [security2:error] [pid 27318:tid 27318] [client 8.137.38.98:59838] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||weathercarib.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "weathercarib.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aidEuBJUPGm-FkXAPGzGdAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 22:03:07
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 18:02:59.442580 2026] [security2:error] [pid 18560:tid 18560] [client 8.137.38.98:56558] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||americanexportimport.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "americanexportimport.com"] [uri "/cgi-bin/php.exe"] [unique_id "aic8EwlrUm2k5shaLxJv5gAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 14:52:27
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 10:52:22.055190 2026] [security2:error] [pid 9986:tid 9986] [client 8.137.38.98:43266] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||panmaneecnc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "panmaneecnc.com"] [uri "/index.php"] [unique_id "aibXJlmxunZcsEjRLCdZrwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 13:13:49
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 09:13:45.997751 2026] [security2:error] [pid 27872:tid 27872] [client 8.137.38.98:49396] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ispeakmusic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ispeakmusic.com"] [uri "/php-cgi/php.exe"] [unique_id "aibACaXHcISEeqdPpvsT_AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 12:09:50
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210350) triggered by 8.137.38.98 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 08:09:42.284903 2026] [security2:error] [pid 8892:tid 8892] [client 8.137.38.98:43194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||frightlibrary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "frightlibrary.org"] [uri "/cgi-bin/php-cgi.exe"] [unique_id "aiaxBhpMuq9Y7L6jUrKSfAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack