Most probably a Trojan. CoC is server-side and will not be easy to hack.
https://www.virustotal.com/en/file/9db0e7244f9df88a324c64de951b50c7fb5f44844f28098a1b576aeeb59bba6c/analysis/1419350541/
mod_security is enabled in client's server.
Try adding this to root .htaccess in your app.
<IfModule mod_security.c>
SecFilterInheritance Off
</IfModule>
or
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>